"""Shared default-role loader for cloud drivers.

Drivers that need a default-role list (AWS IAM, GCP predefined roles)
call :func:`load_default_roles` with a ``platform_settings`` key and a
built-in fallback list. Admin edits the list via the settings UI; the
fallback keeps the request form workable if the setting is missing.

Kept in its own module so ``gcp_cloud.py`` doesn't have to import from
``aws_cloud.py``.
"""
from __future__ import annotations

import json
from typing import Any

from app.integrations.service import get_platform_setting


async def load_default_roles(
    setting_key: str, fallback: list[dict[str, Any]],
) -> list[dict[str, Any]]:
    """Admin-editable default role list; falls back on missing/invalid."""
    v = await get_platform_setting(setting_key, default=None)
    if isinstance(v, list) and v:
        return [x for x in v if isinstance(x, dict) and x.get("role_key")]
    if isinstance(v, str) and v.strip():
        try:
            parsed = json.loads(v)
            if isinstance(parsed, list) and parsed:
                return [
                    x for x in parsed
                    if isinstance(x, dict) and x.get("role_key")
                ]
        except ValueError:
            pass
    return list(fallback)


__all__ = ["load_default_roles"]