from prowler.lib.check.models import Check, CheckReportLinode
from prowler.providers.linode.services.administration.administration_client import (
    administration_client,
)


class administration_user_2fa_enabled(Check):
    """Check if Linode account users have two-factor authentication enabled."""

    def execute(self) -> list[CheckReportLinode]:
        """Execute the administration_user_2fa_enabled check.

        Iterates over all account users and checks whether two-factor
        authentication is enabled.

        Returns:
            list[CheckReportLinode]: A list of findings for each user.
        """
        findings = []

        for user in administration_client.users:
            report = CheckReportLinode(
                metadata=self.metadata(),
                resource=user,
                resource_name=user.username,
                resource_id=user.username,
                region="global",
            )

            if user.tfa_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"User '{user.username}' has two-factor authentication enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"User '{user.username}' does not have two-factor authentication enabled."

            findings.append(report)

        return findings
