# -*- coding: utf-8 -*- #
# Copyright 2021 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Common flags for workforce pools commands."""

from googlecloudsdk.calliope import arg_parsers
from googlecloudsdk.calliope import base


def AddParentFlags(parser, verb):
  parser.add_argument(
      '--organization',
      help='The parent organization of the workforce pool{0} to {1}.'.format(
          's' if verb == 'list' else '', verb
      ),
      required=True,
  )


def AddLocationFlag(parser, verb):
  parser.add_argument(
      '--location',
      help='The location of the workforce pool{0} to {1}.'.format(
          's' if verb == 'list' else '', verb
      ),
      required=True,
  )


def ParseLocation(args):
  if not args.IsSpecified('location'):
    return 'locations/global'
  return 'locations/{}'.format(args.location)


def AddClearableExtendedAttributesOAuth2Client():
  """Creates an ArgumentGroup for clearable OAuth2Client attributes.

  Used for the update-oidc command.

  Returns:
    A list containing a base.ArgumentGroup for clearable OAuth2Client
    attributes.
  """
  clear_extended_attributes_config_arg = base.Argument(
      '--clear-extended-attributes-config',
      dest='clear_extended_attributes_config',
      action='store_true',
      required=False,
      help='Clear the extended attributes configuration.',
  )

  clearable_extended_attributes_group = base.ArgumentGroup(
      mutex=True,
  )
  clearable_extended_attributes_group.AddArgument(
      clear_extended_attributes_config_arg
  )
  clearable_extended_attributes_group.AddArgument(
      ExtendedAttributesOAuth2ClientAttributesGroup(required=False)
  )

  return [clearable_extended_attributes_group]


def AddExtendedAttributesOAuth2Client():
  """Creates an ArgumentGroup for ExtendedAttributesOAuth2Client Attributes.

  Used for the create-oidc command.

  Returns:
    A list containing a base.ArgumentGroup for ExtendedAttributesOAuth2Client
    attributes.
  """
  return [
      ExtendedAttributesOAuth2ClientAttributesGroup(),
  ]


def ExtendedAttributesOAuth2ClientAttributesGroup(required=True):
  """Creates an ArgumentGroup for ExtendedAttributesOAuth2Client Attributes."""
  extended_attributes_client_id_arg = base.Argument(
      '--extended-attributes-client-id',
      dest='extended_attributes_client_id',
      type=str,
      required=required,
      metavar='EXTENDED_ATTRIBUTES_CLIENT_ID',
      help=(
          'The OAuth 2.0 client ID for retrieving extended attributes from the'
          ' identity provider. Required to get extended group memberships for a'
          ' subset of Google Cloud products. The'
          ' --extended-attributes-client-id flag is restricted. We suggest you'
          ' use [SCIM](https://docs.cloud.google.com/iam/docs/configure-scim-oidc-saml)'
          ' instead.'
      ),
  )
  extended_attributes_client_secret_value_arg = base.Argument(
      '--extended-attributes-client-secret-value',
      dest='extended_attributes_client_secret_value',
      type=str,
      required=required,
      metavar='EXTENDED_ATTRIBUTES_CLIENT_SECRET_VALUE',
      help=(
          'The OAuth 2.0 client secret for retrieving extended attributes from'
          ' the identity provider. Required to get extended group memberships'
          ' for a subset of Google Cloud products. The'
          ' --extended-attributes-client-secret-value flag is restricted. We'
          ' suggest you use'
          ' [SCIM](https://docs.cloud.google.com/iam/docs/configure-scim-oidc-saml)'
          ' instead.'
      ),
  )
  extended_attributes_issuer_uri_arg = base.Argument(
      '--extended-attributes-issuer-uri',
      dest='extended_attributes_issuer_uri',
      type=str,
      required=required,
      metavar='EXTENDED_ATTRIBUTES_ISSUER_URI',
      help=(
          "OIDC identity provider's issuer URI. Must be a valid URI using the"
          ' `https` scheme. Required to get the OIDC discovery document. The'
          ' --extended-attributes-issuer-uri flag is restricted. We suggest you'
          ' use [SCIM](https://docs.cloud.google.com/iam/docs/configure-scim-oidc-saml)'
          ' instead.'
      ),
  )
  # Adding this flag as a ArgList to hide `AZURE_AD_GROUPS_DISPLAY_NAME` from
  # the end user. Currently there is no other way to hide new enum choices.
  # These flags will move back to enum types once feature is ready for launch
  extended_attributes_type_arg = base.Argument(
      '--extended-attributes-type',
      dest='extended_attributes_type',
      type=arg_parsers.ArgList(
          choices=[
              'azure-ad-groups-id',
          ],
          max_length=1,
          min_length=1,
      ),
      required=required,
      metavar='EXTENDED_ATTRIBUTES_TYPE',
      help=(
          'Represents the identity provider and type of claims that should be'
          ' fetched. The --extended-attributes-type flag is restricted. We'
          ' suggest you use'
          ' [SCIM](https://docs.cloud.google.com/iam/docs/configure-scim-oidc-saml)'
          ' instead.'
      ),
  )
  extended_attributes_filter_arg = base.Argument(
      '--extended-attributes-filter',
      dest='extended_attributes_filter',
      type=str,
      required=False,
      metavar='EXTENDED_ATTRIBUTES_FILTER',
      help=(
          'The filter used to request specific records from the IdP. By'
          ' default, all of the groups that are associated with a user are'
          ' fetched. For Microsoft Entra ID, you can add `$search` query'
          ' parameters using'
          ' [Keyword Query Language]('
          'https://learn.microsoft.com/en-us/sharepoint/dev/'
          'general-development/'
          'keyword-query-language-kql-syntax-reference).'
          ' To learn more about `$search` querying in Microsoft'
          ' Entra ID, see [Use the `$search` query parameter]('
          'https://learn.microsoft.com/en-us/graph/search-query-parameter).'
          ' \n\nAdditionally, Workforce Identity Federation automatically'
          ' adds the following [`$filter` query parameters]('
          'https://learn.microsoft.com/en-us/graph/filter-query-parameter),'
          ' based on the value of `attributes_type`. Values passed to'
          ' `filter` are converted to `$search` query parameters.'
          ' Additional `$filter` query parameters cannot be added using'
          ' this field. \n\n*'
          ' `AZURE_AD_GROUPS_ID`: `securityEnabled` filter is applied. \n\n'
          ' The --extended-attributes-filter flag is restricted.'
          ' We suggest you use'
          ' [SCIM]('
          'https://docs.cloud.google.com/iam/docs/'
          'configure-scim-oidc-saml)'
          ' instead.'
      ),
  )
  create_extended_attributes_group = base.ArgumentGroup()
  create_extended_attributes_group.AddArgument(
      extended_attributes_client_id_arg
  )
  create_extended_attributes_group.AddArgument(
      extended_attributes_client_secret_value_arg
  )
  create_extended_attributes_group.AddArgument(
      extended_attributes_issuer_uri_arg
  )
  create_extended_attributes_group.AddArgument(extended_attributes_type_arg)
  create_extended_attributes_group.AddArgument(extended_attributes_filter_arg)

  return create_extended_attributes_group
