Handle access changes

import json
import re
import uuid
from pathlib import Path
from urllib.parse import urlsplit

import requests
from access_control import AccessControlStore

PAYWISE_API_URL = "https://api-sandbox.paywise.de"
PAYWISE_PARTNER_KEY = "pw_sbx_your_partner_key"
VERIFIED_ACCESS_EVENT_PATH = "./verified-access-event.json"

ACCESS_EVENT_TYPES = {
    "company.access.confirmed",
    "company.access.revoked",
    "company.access.restored",
}
UUID_PATTERN = re.compile(
    r"^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-"
    r"[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$"
)
TIMEOUT = (5, 30)




def require_uuid(value, field):
    if not isinstance(value, str) or UUID_PATTERN.fullmatch(value) is None:
        raise ValueError(f"{field} must be a UUID")
    uuid.UUID(value)
    return value


def require_partner_sandbox(session, base_url):
    response = session.get(
        f"{base_url}/partner/v2/info/",
        timeout=TIMEOUT,
    )
    if response.status_code != 200:
        response.raise_for_status()
        raise RuntimeError(f"Expected 200, received {response.status_code}")
    environments = [
        value
        for name, value in response.headers.items()
        if name.lower() == "x-paywise-environment"
    ]
    if environments != ["sandbox"]:
        raise RuntimeError("Refusing reconciliation without exact sandbox proof")


def reconcile_access_event():
    base_url = PAYWISE_API_URL
    base = urlsplit(base_url)
    if (
        base.scheme != "https"
        or not base.hostname
        or base.username is not None
        or base.password is not None
    ):
        raise ValueError("PAYWISE_API_URL must be an HTTPS URL")

    session = requests.Session()
    session.headers.update(
        {"Authorization": f"Bearer {PAYWISE_PARTNER_KEY}"}
    )
    require_partner_sandbox(session, base_url)

    event_path = Path(VERIFIED_ACCESS_EVENT_PATH)
    event_body = event_path.read_bytes()
    try:
        event = json.loads(event_body)
    except (UnicodeDecodeError, json.JSONDecodeError) as error:
        raise ValueError("Verified access event must be valid JSON") from error
    if not isinstance(event, dict) or event.get("type") not in ACCESS_EVENT_TYPES:
        raise ValueError("Unexpected Partner access event type")
    data = event.get("data")
    if not isinstance(data, dict):
        raise ValueError("Access event data must be an object")
    event_id = require_uuid(event.get("id"), "event.id")
    company_id = require_uuid(data.get("company_id"), "event.data.company_id")
    authorization_version = data.get("authorization_version")
    if type(authorization_version) is not int or authorization_version <= 0:
        raise ValueError("authorization_version must be a positive integer")

    store = AccessControlStore()
    store.accept_event(
        event_id=event_id,
        company_id=company_id,
        authorization_version=authorization_version,
        body=event_body,
    )
    store.gate_company(company_id=company_id)

    company_url = f"{base_url}/partner/v2/companies/{company_id}/"
    try:
        response = session.get(
            company_url,
            timeout=TIMEOUT,
        )
    except requests.RequestException:
        store.retain_gate(
            company_id=company_id,
            reason="transport-error",
        )
        raise

    if response.status_code == 404:
        store.apply_current_state(
            event_id=event_id,
            company_id=company_id,
            authorization_version=authorization_version,
            event_body=event_body,
            company_request_url=company_url,
            company_response_body=response.content,
            company_http_status=response.status_code,
            case_access="unavailable",
            case_submission_readiness=None,
            reconciliation="pending",
        )
        store.retain_gate(
            company_id=company_id,
            reason="company-hidden",
            http_status=404,
        )
        return {"case_access": "unavailable", "reconciliation": "pending"}

    if response.status_code != 200:
        store.retain_gate(
            company_id=company_id,
            reason="http-error",
            http_status=response.status_code,
        )
        response.raise_for_status()
        raise RuntimeError(f"Expected 200, received {response.status_code}")

    try:
        current = response.json()
    except ValueError as error:
        store.retain_gate(
            company_id=company_id,
            reason="invalid-company-response",
        )
        raise RuntimeError("Company response was not valid JSON") from error
    if not isinstance(current, dict):
        store.retain_gate(
            company_id=company_id,
            reason="invalid-company-response",
        )
        raise RuntimeError("Company response must be an object")
    if current.get("id") != company_id:
        store.retain_gate(
            company_id=company_id,
            reason="company-identity-mismatch",
        )
        raise RuntimeError("Company response identity mismatch")
    current_access = current.get("case_access")
    if current_access not in {"available", "unavailable"}:
        store.retain_gate(
            company_id=company_id,
            reason="invalid-company-response",
        )
        raise RuntimeError("Company response has no verified access state")
    current_readiness = current.get("case_submission_readiness")

    if current_access == "available":
        store.apply_current_state(
            event_id=event_id,
            company_id=company_id,
            authorization_version=authorization_version,
            event_body=event_body,
            company_request_url=company_url,
            company_response_body=response.content,
            company_http_status=response.status_code,
            case_access="available",
            case_submission_readiness=current_readiness,
            reconciliation="complete",
        )
        store.release_company(company_id=company_id)
        return {"case_access": "available", "reconciliation": "complete"}

    store.apply_current_state(
        event_id=event_id,
        company_id=company_id,
        authorization_version=authorization_version,
        event_body=event_body,
        company_request_url=company_url,
        company_response_body=response.content,
        company_http_status=response.status_code,
        case_access="unavailable",
        case_submission_readiness=current_readiness,
        reconciliation="complete",
    )
    store.retain_gate(
        company_id=company_id,
        reason="current-access-unavailable",
    )
    return {"case_access": "unavailable", "reconciliation": "complete"}


ACCESS_HANDLER_RESULT = reconcile_access_event()