"""Integration tests on the sync cli, ensure sync one writes succeed."""

import os

import boto3
import pytest
from mypy_boto3_secretsmanager import SecretsManagerClient

from m2mconfig.schemas import ClientCredentials

from tests.integration.utils import run_command

INTEGRATION_TEST_CLIENT_CREDENTIALS_SECRET_ID = (
    "qa/auth0-m2m-config-integration-tests/M2M_AUTH0_CLIENT_CREDENTIALS"
)
secrets_manager_client: SecretsManagerClient = boto3.client("secretsmanager")


@pytest.fixture()
def current_env() -> dict[str, str]:
    """Get existing and update environment variables for test suite."""
    current_env = os.environ.copy()
    current_env["AUTH0_DOMAIN"] = "qa-orchard.auth0.com"
    return current_env


@pytest.fixture()
def clobber_integration_test_client_credentials(
    secret_id: str = INTEGRATION_TEST_CLIENT_CREDENTIALS_SECRET_ID,
) -> None:
    """Fixture will reset the test client credential."""
    reset_client_credentials = ClientCredentials(
        audience="https://qa-ows.theorchard.io",
        client_id="yrF1X41CtSc1UwBsdZxv3pph8H8rNAiX",
        client_secret="cs",
    )
    secrets_manager_client.put_secret_value(
        SecretId=secret_id,
        SecretString=reset_client_credentials.model_dump_json(),
    )


def get_integration_test_client_credentials(
    secret_id: str = INTEGRATION_TEST_CLIENT_CREDENTIALS_SECRET_ID,
) -> ClientCredentials:
    """Get integration test's current client credential value from AWS Secrets Manager."""
    result = secrets_manager_client.get_secret_value(SecretId=secret_id)
    return ClientCredentials.model_validate_json(result["SecretString"])


def test_sync_client_credentials(
    current_env: dict[str, str],
    clobber_integration_test_client_credentials: None,
) -> None:
    """Test client credentials are restored."""
    previous_secret = get_integration_test_client_credentials()

    command_args = [
        "poetry",
        "run",
        "m2mconfig",
        "sync",
        "one",
        "qa",
        "auth0-m2m-config-integration-tests",
        "--overwrite-secret",
    ]
    run_command(
        command_args,
        expected_returncode=0,
        env=current_env,
    )

    current_secret = get_integration_test_client_credentials()
    assert previous_secret.audience == current_secret.audience
    assert previous_secret.client_id == current_secret.client_id
    assert previous_secret.grant_type == current_secret.grant_type
    assert previous_secret.client_secret != current_secret.client_secret


def test_rotate_client_credentials(
    current_env: dict[str, str],
) -> None:
    """Test client credentials are rotated."""
    previous_secret = get_integration_test_client_credentials()

    command_args = [
        "poetry",
        "run",
        "m2mconfig",
        "sync",
        "one",
        "qa",
        "auth0-m2m-config-integration-tests",
        "--rotate-secret",
    ]
    run_command(
        command_args,
        expected_returncode=0,
        env=current_env,
    )

    current_secret = get_integration_test_client_credentials()
    assert previous_secret.audience == current_secret.audience
    assert previous_secret.client_id == current_secret.client_id
    assert previous_secret.grant_type == current_secret.grant_type
    assert previous_secret.client_secret != current_secret.client_secret