"""
Copyright (c) Contributors to the Open 3D Engine Project.
For complete copyright and license terms please see the LICENSE at the root of this distribution.

SPDX-License-Identifier: Apache-2.0 OR MIT
"""

from aws_cdk import (
    CfnOutput,
    Environment,
    aws_cognito as cognito
)
from constructs import Construct

from auth.cognito_user_pool_sms_role import CognitoUserPoolSMSRole
from utils import name_utils


class CognitoUserPool:
    """
    Creates User pool. Sets up MFA with text. Allows enabling MFA. Allows signing up by email and phone.
    """

    def __init__(self, scope: Construct, feature_name: str, project_name: str, env: Environment,
                 sms_role: CognitoUserPoolSMSRole) -> None:
        """
        :param scope: Construct role scope will be attached to.
        :param feature_name: Name of the feature for resource.
        :param project_name: Name of the project for resource.
        :param env: Environment set up by App.
        :param sms_role: SMS IAM role created using
        """
        self._user_pool = \
            cognito.CfnUserPool(scope, name_utils.format_aws_resource_id(feature_name, project_name, env,
                                                                         cognito.CfnUserPool.__name__),
                                user_pool_name=name_utils.format_aws_resource_name(feature_name,
                                                                                   project_name, env,
                                                                                   cognito.CfnUserPool.__name__),
                                admin_create_user_config=cognito.CfnUserPool.AdminCreateUserConfigProperty(
                                    allow_admin_create_user_only=False),
                                account_recovery_setting=cognito.CfnUserPool.AccountRecoverySettingProperty(
                                    recovery_mechanisms=[cognito.CfnUserPool.RecoveryOptionProperty(
                                        name='verified_email', priority=1),
                                        cognito.CfnUserPool.RecoveryOptionProperty(
                                            name='verified_phone_number', priority=2)]),
                                auto_verified_attributes=['email', 'phone_number'],
                                enabled_mfas=['SMS_MFA'],
                                mfa_configuration='OPTIONAL',
                                sms_configuration=cognito.CfnUserPool.SmsConfigurationProperty(
                                    external_id=name_utils.format_aws_resource_name(feature_name,
                                                                                    project_name, env,
                                                                                    cognito.CfnUserPool.__name__) + '-external',
                                    sns_caller_arn=sms_role.get_role().role_arn))

        self._user_pool.node.add_dependency(sms_role.get_role())
        self._user_pool_client \
            = cognito.CfnUserPoolClient(scope, name_utils.format_aws_resource_id(feature_name, project_name,
                                                                                 env,
                                                                                 cognito.CfnUserPoolClient.__name__),
                                        client_name=name_utils.format_aws_resource_name(feature_name,
                                                                                        project_name,
                                                                                        env,
                                                                                        cognito.CfnUserPoolClient.__name__),
                                        user_pool_id=self._user_pool.ref,
                                        explicit_auth_flows=['ALLOW_ADMIN_USER_PASSWORD_AUTH',
                                                             'ALLOW_CUSTOM_AUTH',
                                                             'ALLOW_USER_PASSWORD_AUTH',
                                                             'ALLOW_USER_SRP_AUTH',
                                                             'ALLOW_REFRESH_TOKEN_AUTH'],
                                        # access_token_validity=5, # Does not work
                                        # id_token_validity=5,  # Does not work
                                        # refresh_token_validity=30,  # Does not work
                                        )
        self._user_pool_client.add_depends_on(self._user_pool)

        CfnOutput(
            scope,
            'CognitoUserPoolId',
            description="Cognito User pool id",
            value=self._user_pool.ref)

        CfnOutput(
            scope,
            'CognitoUserPoolAppClientId',
            description="Cognito User pool App client id",
            value=self._user_pool_client.ref)

    def get_user_pool(self) -> cognito.CfnUserPool:
        """
        :return: Cognito user pool
        """
        return self._user_pool

    def get_user_pool_client(self) -> cognito.CfnUserPoolClient:
        """
        :return: Cognito user pool client.
        """
        return self._user_pool_client

    def create_using_higher_construct(self):
        raise NotImplemented('Add implementation')
        # # Below does not work as Creating App client without refresh tokens auth flow param is not accepted by CF.
        # # Create Cognito user pool
        # user_pool = cognito.UserPool(scope,
        #                                  id=name_utils.format_aws_resource_id(stack_feature_name, project_name, env,
        #                                                                       cognito.UserPool.__name__),
        #                                  user_pool_name=name_utils.format_aws_resource_name(stack_feature_name,
        #                                                                                     project_name, env,
        #                                                                                     cognito.UserPool.__name__),
        #                                  mfa=cognito.Mfa.OPTIONAL,
        #                                  mfa_second_factor=cognito.MfaSecondFactor(otp=False, sms=True),
        #                                  enable_sms_role=True,
        #                                  sms_role=sms_role.get_role(),
        #                                  sms_role_external_id='c87467be-4f34-11ea-b77f-2e728ce88125',
        #                                  self_sign_up_enabled=True)
        #
        # user_pool_client = user_pool.add_client(
        #     name_utils.format_aws_resource_id(stack_feature_name, project_name, env,
        #                                          cognito.UserPoolClient.__name__),
        #     # access_token_validity=core.Duration.minutes(6),
        #     auth_flows=cognito.AuthFlow(admin_user_password=True),
        #     # id_token_validity=core.Duration.minutes(6),
        #     user_pool_client_name=name_utils.format_aws_resource_name(stack_feature_name, project_name, env,
        #                                                               cognito.UserPoolClient.__name__),
        #     disable_o_auth=True)
