from oslo_policy import policy

# Define your custom rules with descriptions
rules = [
    # Default deny rule
    policy.RuleDefault(
        name='default',
        check_str='!',
        description='Default rule that denies all actions unless explicitly allowed'
    ),

    # Role hierarchy helper rules
    policy.RuleDefault(
        name='is_admin',
        check_str='role:admin',
        description='Check if user has admin role'
    ),
    policy.RuleDefault(
        name='is_vigie_operator',
        check_str='role:vigie_operator or role:admin',
        description='Check if user has vigie_operator or admin role (can perform all operations)'
    ),

    # Admin only rules
    policy.DocumentedRuleDefault(
        name='vigie:services_list',
        check_str='rule:is_admin', 
        description='List registered Vigie services (Admin only).',
        operations=[
            {
                'method': 'GET',
                'path': '/v2/services-list'
            }
        ]
    ),
    policy.DocumentedRuleDefault(
        name='vigie:service_update',
        check_str='rule:is_admin',
        description='Set a service to enabled or disabled.',
        operations=[
            {
                'method': 'PUT',
                'path': '/v2/service/<service_id>'
            }
        ]
    ),
    policy.DocumentedRuleDefault(
        name='vigie:services_delete',
        check_str='rule:is_admin',
        description='Delete one or more registered Vigie services.',
        operations=[
            {
                'method': 'POST',
                'path': '/v2/services-delete'
            }
        ]
    ),

    # API-specific rules using helper rules (cleaner and more maintainable)
    policy.DocumentedRuleDefault(
        name='vigie:evacuate_compute',
        check_str='rule:is_vigie_operator',
        description='Evacuate a compute',
        operations=[
            {
                'method': 'POST',
                'path': '/v2/evacutate-compute'
            }
        ]
    ),
    policy.DocumentedRuleDefault(
        name='vigie:validate_compute',
        check_str='rule:is_vigie_operator',
        description='Validate a compute by spawning a VM on it.',
        operations=[
            {
                'method': 'POST',
                'path': '/v2/validate-compute'
            }
        ]
    ),
    policy.DocumentedRuleDefault(
        name='vigie:tasks_list',
        check_str='rule:is_vigie_operator',
        description='List tasks.',
        operations=[
            {
                'method': 'POST',
                'path': '/v2/tasks-list'
            }
        ]
    ),
    policy.DocumentedRuleDefault(
        name='vigie:tasks_delete',
        check_str='rule:is_vigie_operator',
        description='Delete task(s).',
        operations=[
            {
                'method': 'POST',
                'path': '/v2/tasks-delete'
            }
        ]
    ),
    policy.DocumentedRuleDefault(
        name='vigie:purge_project',
        check_str='rule:is_vigie_operator',
        description='Remove a VM from migration scheduler',
        operations=[
            {
                'method': 'POST',
                'path': '/v2/purge-project'
            }
        ]
    ),
]

def list_rules():
    return rules
