"""Lambda test module."""

import datetime

from src import app as index

import pytest


@pytest.fixture()
def patch_iam_client(iam_client, monkeypatch):
    """Patch the global IAM client with a mocked one."""
    monkeypatch.setattr(index, 'client', iam_client)
    return iam_client


@pytest.fixture()
def patch_sts_client(sts_client, monkeypatch):
    """Patch the global IAM client with a mocked one."""
    monkeypatch.setattr(index, 'sts_client', sts_client)
    return sts_client


def test_create_and_attach_policy(patch_iam_client, iam_user, policy_json):
    """Test create_and_attach_policy function."""
    now = datetime.datetime.now()
    today_formatted = now.strftime('%Y-%m-%d')
    result = index.create_and_attach_policy(iam_user, policy_json)
    assert result.startswith(f'BreakGlass-{iam_user}-{today_formatted}')


def test_format_policy_document(break_glass_role_arn):  # noqa: E501
    """Test format_policy_document function."""
    policy = index.format_policy_document('policy.json', break_glass_role_arn)  # noqa: E501
    assert policy['Statement'][0]['Resource'] == break_glass_role_arn


def test_get_aws_user_by_email_tag_multiple(patch_iam_client, iam_users):
    """Test get_aws_user_by_email_tag with multiple users found."""
    email = "test_iam_user@theorchard.com"
    with pytest.raises(ValueError) as exc_info:
        _ = index.get_aws_user_by_email_tag(email)
    iam_users_str = ','.join(iam_users)
    assert f"Found multiple users with email tag {email}: {iam_users_str}" in str(exc_info.value)  # noqa: E501


def test_get_aws_user_by_email_tag_none(patch_iam_client):
    """Test get_user_from_event function when user doesn't exist."""
    email = "test_iam_user@theorchard.com"
    with pytest.raises(ValueError) as exc_info:
        _ = index.get_aws_user_by_email_tag(email)
    assert f"Cannot find user with email tag {email}" in str(exc_info.value)


def test_get_user_from_event(patch_iam_client, iam_user, event_json):
    """Test get_user_from_event function."""
    result = index.get_user_from_event(event_json)
    assert result == iam_user


def test_generate_break_glass_command(break_glass_role_arn, iam_user,
                                      create_mfa_device):
    """Test generate_break_glass_command function."""
    response = index.generate_break_glass_command(iam_user, create_mfa_device,
                                                  break_glass_role_arn)

    command = f'eval $(aws sts assume-role --role-arn {break_glass_role_arn} '\
        f'--role-session-name {iam_user} --serial-number {create_mfa_device} '\
        "--token-code MFA_TOKEN_CODE | jq -r '.Credentials | "\
        '"export AWS_ACCESS_KEY_ID=\(.AccessKeyId)\\nexport '\
        'AWS_SECRET_ACCESS_KEY=\(.SecretAccessKey)\\nexport '\
        'AWS_SESSION_TOKEN=\(.SessionToken)\\n"\')'  # noqa: W605
    explanation = 'Run this command within 15 minutes, substituting '\
        'a real MFA code for MFA_TOKEN_CODE'
    assert response == f'{explanation}: {command}'


def test_verify_break_glass_role(patch_iam_client, patch_sts_client,
                                 break_glass_role_name, break_glass_role_arn,
                                 verify_role_arn, mock_account_id):
    """Test verify_break_glass_role function."""
    result = index.verify_break_glass_role(break_glass_role_name, verify_role_arn)  # noqa: E501
    assert result == break_glass_role_arn


def test_verify_mfa_device(patch_iam_client, create_mfa_device, iam_user):
    """Test verify_mfa_device function."""
    result = index.verify_mfa_device(iam_user)
    assert result == create_mfa_device