#!/usr/bin/env python3
# /// script
# requires-python = ">=3.10"
# dependencies = ["pytest"]
# ///

import pytest
from arn_patterns import ARN_PATTERNS


def match_arn(arn: str) -> tuple[str, str, dict] | None:
    """Match ARN against patterns, return (service, resource_type, groups) or None."""
    parts = arn.split(":")
    if len(parts) < 3:
        return None
    service = parts[2]

    if service not in ARN_PATTERNS:
        return None

    for regex, resource_type in ARN_PATTERNS[service]:
        m = regex.match(arn)
        if m:
            return (service, resource_type, m.groupdict())

    return None


class TestS3:
    def test_object_matches_before_bucket(self):
        result = match_arn("arn:aws:s3:::my-bucket/path/to/object.txt")
        assert result == ("s3", "object", {
            "Partition": "aws",
            "BucketName": "my-bucket",
            "ObjectName": "path/to/object.txt",
        })

    def test_bucket(self):
        result = match_arn("arn:aws:s3:::my-bucket")
        assert result == ("s3", "bucket", {
            "Partition": "aws",
            "BucketName": "my-bucket",
        })

    def test_accesspoint_object_before_accesspoint(self):
        result = match_arn("arn:aws:s3:us-east-1:123456789012:accesspoint/my-ap/object/my-key")
        assert result == ("s3", "accesspointobject", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "AccessPointName": "my-ap",
            "ObjectName": "my-key",
        })

    def test_accesspoint(self):
        result = match_arn("arn:aws:s3:us-east-1:123456789012:accesspoint/my-ap")
        assert result == ("s3", "accesspoint", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "AccessPointName": "my-ap",
        })


class TestLambda:
    def test_function_alias_before_function(self):
        result = match_arn("arn:aws:lambda:us-east-1:123456789012:function:my-func:PROD")
        assert result == ("lambda", "function alias", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "FunctionName": "my-func",
            "Alias": "PROD",
        })

    def test_function(self):
        result = match_arn("arn:aws:lambda:us-east-1:123456789012:function:my-func")
        assert result == ("lambda", "function", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "FunctionName": "my-func",
        })


class TestIAM:
    def test_user(self):
        result = match_arn("arn:aws:iam::123456789012:user/johndoe")
        assert result == ("iam", "user", {
            "Partition": "aws",
            "Account": "123456789012",
            "AwsUserName": "johndoe",
        })

    def test_role(self):
        result = match_arn("arn:aws:iam::123456789012:role/MyRole")
        assert result == ("iam", "role", {
            "Partition": "aws",
            "Account": "123456789012",
            "RoleNameWithPath": "MyRole",
        })


class TestEC2:
    def test_instance(self):
        result = match_arn("arn:aws:ec2:us-west-2:123456789012:instance/i-1234567890abcdef0")
        assert result == ("ec2", "instance", {
            "Partition": "aws",
            "Region": "us-west-2",
            "Account": "123456789012",
            "InstanceId": "i-1234567890abcdef0",
        })


class TestAPIGateway:
    def test_stage(self):
        result = match_arn("arn:aws:apigateway:us-east-1::/restapis/abc123/stages/prod")
        assert result[0] == "apigateway"
        assert result[2]["Region"] == "us-east-1"
        assert result[2]["StageName"] == "prod"

    def test_restapi(self):
        result = match_arn("arn:aws:apigateway:us-east-1::/restapis/abc123")
        assert result == ("apigateway", "RestApi", {
            "Partition": "aws",
            "Region": "us-east-1",
            "RestApiId": "abc123",
        })


class TestIdentityStore:
    def test_specific_before_wildcard(self):
        result = match_arn("arn:aws:identitystore:::group/g-123456")
        assert result == ("identitystore", "Group", {
            "Partition": "aws",
            "GroupId": "g-123456",
        })


class TestOtherServices:
    def test_dynamodb_table(self):
        result = match_arn("arn:aws:dynamodb:us-east-1:123456789012:table/MyTable")
        assert result == ("dynamodb", "table", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "TableName": "MyTable",
        })

    def test_sqs_queue(self):
        result = match_arn("arn:aws:sqs:us-east-1:123456789012:my-queue")
        assert result == ("sqs", "queue", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "QueueName": "my-queue",
        })

    def test_sns_topic(self):
        result = match_arn("arn:aws:sns:us-east-1:123456789012:my-topic")
        assert result == ("sns", "topic", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "TopicName": "my-topic",
        })

    def test_kms_key(self):
        result = match_arn("arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab")
        assert result == ("kms", "key", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
        })

    def test_secretsmanager_secret(self):
        result = match_arn("arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret-abc123")
        assert result == ("secretsmanager", "Secret", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "SecretId": "my-secret-abc123",
        })

    def test_ecs_cluster(self):
        result = match_arn("arn:aws:ecs:us-east-1:123456789012:cluster/my-cluster")
        assert result == ("ecs", "cluster", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "ClusterName": "my-cluster",
        })

    def test_ecs_service(self):
        result = match_arn("arn:aws:ecs:us-east-1:123456789012:service/my-cluster/my-service")
        assert result == ("ecs", "service", {
            "Partition": "aws",
            "Region": "us-east-1",
            "Account": "123456789012",
            "ClusterName": "my-cluster",
            "ServiceName": "my-service",
        })
