import base64
import json

import pytest
from flask import url_for
from jose import jwt

from auth_api import config
from auth_api.users import current_user

TEST_DNA_BEARER_TOKEN = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzbWUtZG5hfDNhNDdjNDY3MzM5YTE3MGNiMWEyODcwNjhiNmU2MzhiIiwiZW1haWwiOiJhcnRlbS5tZXJrdWxvdi5zbWVAc29ueW11c2ljLmNvbSIsIm5hbWUiOiJBcnRlbSBNZXJrdWxvdiIsImlzcyI6ImF0bGFzdW0iLCJpYXQiOjE2NDAzNDcxNjYsImV4cCI6MTY0MDM0ODA2NiwibmJmIjoxNjQwMzQ3MTY2fQ.TvRX-IIHz5enzHjQqJTIiGUVbz2aq_ncHI8PNX9D0DjznzzGH3UtgkDnEMfay5Qp7vkpm2BjVb6oGQ3qXcV7q4YQvdPkH3yvR41TliqGnir1WqV5nWHGODETZ272dKZIvWkFKjMx_bZqmo_xFnEMqptQiBZs6mmlU_KyfnZMKlzqBZwd78I44cABuCFiT7nEgOU2ccedZg2El2x-g3q8b7Ierb8inlOnHlhCuVrNSqlAZPWYAwhI4cJkL9to5J7G6BkgnYEQl0e2rBLQUsllP7zoKv7GMDtaxChrZYnivK7f-WtGcgQpbGT4rrEo4uerKNKTqWuPHA4e42F6ycy_s0cvleZ2okM0_gaCZhKW7BrGyYdVodMBNofwj55_epz34uEnI6yOI4NJM0hkmqsl4RQejEjWVvKkFZ6eNPKVuTVH2zxI0qMtuwGIGvncOCkJuIAbuhOW2mbd6PdEydz8ArTUH-ENbsRh6RENgLsCp7qeCqBrNCVZ1mLHcqqSLjJILQpW2eg4SZH-V_azHnNiNdlZ74oWJEdfHhnMuVFKZMdP9JiBYegfgwSfU15jhxA70dUegY8x76Fuof48uEGaeYXGIS_GlCp5SUTOLctaiF8801gG1o3VbN7O-jtBNofOiYxuXAR3e0EBe0eGkfqs9aLJ50yTOdnsPBd1XvlpdRQ"  # noqa
TEST_M2M_BEARER_TOKEN = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJlYjczMDYxMy1jNDRlLTQyMzEtYTlhMi1kM2YyMDUyNTYzODAiLCJhdWQiOiJhdGxhc3VtfGFwaV9yZWFkIiwibmFtZSI6ImFwaSIsInNjb3BlIjoiIiwiaXNzIjoiYXRsYXN1bSIsImlhdCI6MTY0OTc2MjYxMSwiZXhwIjoxNjQ5ODQ5MDExLCJuYmYiOjE2NDk3NjI2MTF9.qnFeNgXPG8QGmmOOwZGb8a0YWQ8cmc911DsCqPsCCLFgsrgrEVcl6EAUvymNzvsVAHwiGJZTeLOqkUJTJz4myh-b0l-LxzCmmaqJ2Xd8Wfb58EQbyK0FF7hbJwVZ_f2s46fsMkVHxtk13WX9RgGxBYP7cvGdB28DaLpN5Xe9Oy80lso8VhHeh85CMoUzpnmKmlkTVU5gmF28t7NZzie5pLpbkvUpv2N52sMQNQZyMKccC7Vjdq-2rRwbeQ8WiAx6yIpENHX2RcBQpKI-zBWC3011vY1VP60BaSPawbndNhE4o0c4LUKylnd4rU22HJIJfLnvzVZB2XAnHWMmvsDGhabUpaoSxI_yIkuCtk75RvYVFBfOa0n4OK3ow2M3YVystlKtFpkNMwVugl_DGDYJ-6IgCM31PzVp6QEY4Lt1ifvkGwB57vhGLrYYH7FslNE2N3Pq01gLb_WDYF60FhgiQubcre6sAjWSyjrP8z7zJgyDxw491ttcobQJUYHmyZB"  # noqa


def test_auth_failure_bad_auth_params(client, app, mocker):
    mocked_requests_get = mocker.patch("auth_api.providers.atlas.requests.get").return_value
    mocked_requests_get.status_code = 200
    mocked_requests_get.text = "test_key"

    res = client.get(url_for("authorize"))
    assert res.status_code == 401

    res = client.get(url_for("authorize"), headers={"Authorization": f"Bearer {TEST_DNA_BEARER_TOKEN}"})
    assert res.status_code == 401

    client.set_cookie(app.config.get("SERVER_NAME"), config.ATLAS_BEARER_TOKEN_COOKIE_NAME, TEST_DNA_BEARER_TOKEN)
    assert res.status_code == 401


@pytest.mark.parametrize("auth_type", ("header", "cookie"))
def test_auth_user_success_no_resource_group(client, mocker, app, auth_type):
    app.config["RESOURCE_GROUP"] = None
    mocked_get_key = mocker.patch("auth_api.providers.atlas.AtlasAuthProvider.get_key")
    mocked_get_key.return_value = "test_key"
    test_payload = jwt.get_unverified_claims(TEST_DNA_BEARER_TOKEN)
    mocked_decode = mocker.patch.object(jwt, "decode")
    mocked_decode.return_value = test_payload.copy()

    if auth_type == "header":
        res = client.get(url_for("authorize"), headers={"Authorization": f"Bearer {TEST_DNA_BEARER_TOKEN}"})
    elif auth_type == "cookie":
        client.set_cookie(app.config.get("SERVER_NAME"), config.ATLAS_BEARER_TOKEN_COOKIE_NAME, TEST_DNA_BEARER_TOKEN)
        res = client.get(url_for("authorize"))

    assert res.status_code == 200
    assert json.loads(base64.urlsafe_b64decode(res.headers.get("X-Userinfo") + "==")) == current_user.user_info
    assert res.headers.get("X-User-Id") == test_payload.get("sub").split("|")[-1]
    assert res.headers.get("X-User-Id") == current_user.user_id
    assert res.headers.get("X-Client-Id") == test_payload.get("sub")
    assert current_user.user_info == test_payload
    assert current_user.user_id == test_payload.get("sub").split("|")[-1]
    assert current_user.client_id == test_payload.get("sub")
    assert not current_user.is_m2m


@pytest.mark.parametrize("auth_type", ("header", "cookie"))
def test_auth_user_success_resource_group(client, mocker, app, auth_type):
    app.config["RESOURCE_GROUP"] = "test_resource_group"

    mocked_get_key = mocker.patch("auth_api.providers.atlas.AtlasAuthProvider.get_key")
    mocked_get_key.return_value = "test_key"
    test_payload = jwt.get_unverified_claims(TEST_DNA_BEARER_TOKEN)
    test_payload["test_resource_group/test_claim"] = "test_claim_value"
    mocked_decode = mocker.patch.object(jwt, "decode")
    mocked_decode.return_value = test_payload.copy()
    mocked_get_unverified_claims = mocker.patch.object(jwt, "get_unverified_claims")
    mocked_get_unverified_claims.return_value = test_payload.copy()

    if auth_type == "header":
        res = client.get(url_for("authorize"), headers={"Authorization": f"Bearer {TEST_DNA_BEARER_TOKEN}"})
    elif auth_type == "cookie":
        client.set_cookie(app.config.get("SERVER_NAME"), config.ATLAS_BEARER_TOKEN_COOKIE_NAME, TEST_DNA_BEARER_TOKEN)
        res = client.get(url_for("authorize"))

    assert res.status_code == 200
    assert json.loads(base64.urlsafe_b64decode(res.headers.get("X-Userinfo") + "==")) == current_user.user_info
    assert res.headers.get("X-User-Id") == current_user.user_id
    assert res.headers.get("X-User-Id") == test_payload.get("sub").split("|")[-1]
    assert res.headers.get("X-Client-Id") == test_payload.get("sub")
    assert current_user.user_id == test_payload.get("sub").split("|")[-1]
    assert current_user.client_id == test_payload.get("sub")
    assert not current_user.is_m2m


@pytest.mark.parametrize("auth_type", ("header", "cookie"))
def test_auth_user_failure_resource_group(client, mocker, app, auth_type):
    app.config["RESOURCE_GROUP"] = "test_resource_group"

    mocked_get_key = mocker.patch("auth_api.providers.atlas.AtlasAuthProvider.get_key")
    mocked_get_key.return_value = "test_key"
    test_payload = jwt.get_unverified_claims(TEST_DNA_BEARER_TOKEN)
    test_payload["other_resource_group/test_claim"] = "test_claim_value"
    mocked_decode = mocker.patch.object(jwt, "decode")
    mocked_decode.return_value = test_payload.copy()

    if auth_type == "header":
        res = client.get(url_for("authorize"), headers={"Authorization": f"Bearer {TEST_DNA_BEARER_TOKEN}"})
    elif auth_type == "cookie":
        client.set_cookie(app.config.get("SERVER_NAME"), config.ATLAS_BEARER_TOKEN_COOKIE_NAME, TEST_DNA_BEARER_TOKEN)
        res = client.get(url_for("authorize"))

    assert res.status_code == 403


def test_auth_m2m_success(client, mocker, app):
    mocked_get_key = mocker.patch("auth_api.providers.atlas.AtlasAuthProvider.get_key")
    mocked_get_key.return_value = "test_key"
    test_payload = jwt.get_unverified_claims(TEST_M2M_BEARER_TOKEN)
    mocked_decode = mocker.patch.object(jwt, "decode")
    mocked_decode.return_value = test_payload.copy()

    res = client.get(url_for("authorize"), headers={"Authorization": f"Bearer {TEST_M2M_BEARER_TOKEN}"})

    assert res.status_code == 200
    assert res.headers.get("X-User-Id") is None
    assert res.headers.get("X-Client-Id") == test_payload.get("sub")
    assert current_user.user_id is None
    assert current_user.is_m2m
    assert current_user.client_id == test_payload.get("sub")