from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.application.application_client import (
    application_client,
)
from prowler.providers.okta.services.application.application_service import (
    DASHBOARD_APP_NAME,
)
from prowler.providers.okta.services.application.lib.application_helpers import (
    app_label,
    app_not_found_finding,
    missing_app_scope_finding,
    policy_missing_finding,
    rule_label,
    top_active_rule,
)

DASHBOARD_LABEL_HINT = "Okta Dashboard"


class application_dashboard_phishing_resistant_authentication(Check):
    """STIG V-273190 / OKTA-APP-000180.

    The Authentication Policy bound to the Okta Dashboard app must
    restrict possession factors to phishing-resistant authenticators on
    its top active rule
    (`possession.phishingResistant=REQUIRED`).
    """

    def execute(self) -> list[CheckReportOkta]:
        findings: list[CheckReportOkta] = []
        org_domain = application_client.provider.identity.org_domain

        for scope_key in ("built_in_apps", "access_policies"):
            missing_scope = application_client.missing_scope.get(scope_key)
            if missing_scope:
                findings.append(
                    missing_app_scope_finding(
                        self.metadata(),
                        org_domain,
                        missing_scope,
                        DASHBOARD_LABEL_HINT,
                    )
                )
                return findings

        app = application_client.built_in_apps.get(DASHBOARD_APP_NAME)
        if app is None:
            findings.append(
                app_not_found_finding(self.metadata(), org_domain, DASHBOARD_LABEL_HINT)
            )
            return findings

        if app.access_policy_id is None or app.access_policy is None:
            findings.append(policy_missing_finding(self.metadata(), org_domain, app))
            return findings

        report = CheckReportOkta(
            metadata=self.metadata(), resource=app, org_domain=org_domain
        )
        rule = top_active_rule(app)
        if rule is None:
            report.status = "FAIL"
            report.status_extended = (
                f"{app_label(app)} has no active rules on its Authentication "
                "Policy. The top rule must mark "
                "`Possession factor constraints are: Phishing resistant`."
            )
        elif rule.possession_phishing_resistant_required:
            report.status = "PASS"
            report.status_extended = (
                f"Top active {rule_label(rule)} on {app_label(app)} enforces "
                "phishing-resistant possession factors "
                "(`possession.phishingResistant=REQUIRED`)."
            )
        else:
            report.status = "FAIL"
            report.status_extended = (
                f"Top active {rule_label(rule)} on {app_label(app)} does not "
                "enforce phishing-resistant possession factors. Enable "
                "`Possession factor constraints are: Phishing resistant` "
                "on the rule."
            )
        findings.append(report)
        return findings
