'''authorizer_handler.py'''
from pyauthlib import UserInfo, AuthPolicy, HttpMethod, parse_event, raise_401
from my_auth_client import get_client

def lambda_handler(event, _context):
    '''Exchanges access token for user_info and returns the policy.
        Unauthorized users are denied all access.
        Users are allowed read access to all resources.
        Admins are allowed full access to all resources.
    '''
    event = parse_event(event)

    identity = get_client().get_identity(event.access_token)
    user_info = UserInfo(identity['user_id'], identity['grants'])
    policy = AuthPolicy(user_info)

    if not user_info:
        raise_401()
    elif 'ROLE_ADMIN' in user_info.authorities:
        policy.allow(event.arn(method=HttpMethod.ALL, resource='*'))
    else:
        policy.allow(event.arn(method=HttpMethod.GET, resource='*'))

    return policy.build()