"""Tests for the access checks.

We're testing every endpoint that's open to non-admin profiles.
The MoneyhubProfile used in the tests only has access to `MONEYHUB_ACCOUNT_ID`.
"""

import pytest

from tests.integration.conftest import ows_abacus_account_api_client
from tests.integration.consts.headers import ADMIN_HEADERS
from tests.integration.consts.headers import MONEYHUB_HEADERS

MONEYHUB_ACCOUNT_ID = 35598


def _setup(account_id):
    """Create common objects for the tests."""
    admin_client = ows_abacus_account_api_client(ADMIN_HEADERS)

    res = admin_client.post_account({
        'account_id': account_id,
        'account_name': 'Authorized Account',
        'country_of_tax_residence': 'USA'
    })

    assert res.status_code == 201

    res = admin_client.post_account_payment_term({
        'account_id': account_id,
        'currency_code': 'USD',
        'payment_entity_id': 2,
        'payment_schedule': None,
        'payment_minimum': None
    })

    assert res.status_code == 201
    account_payment_term_id = res.json()['account_payment_term_id']

    res = admin_client.get_tax_info_by_account_id(account_id)
    assert res.status_code == 200
    account_tax_info_id = res.json()['account_tax_info_id']

    return {
        'account_id': account_id,
        'account_payment_term_id': account_payment_term_id,
        'account_tax_info_id': account_tax_info_id
    }


@pytest.mark.jira('ACC-8348')
def test_access_check_get_account_by_id(clean_db):
    """Test the access check for `GET /account/<account_id>`."""
    authorized_ids = _setup(MONEYHUB_ACCOUNT_ID)
    unauthorized_ids = _setup(1)
    moneyhub_client = ows_abacus_account_api_client(MONEYHUB_HEADERS)

    # The MoneyhubProfile makes a request for an Account they have access to
    res = moneyhub_client.get_account(authorized_ids['account_id'])
    assert res.status_code == 200
    assert res.json()['account_id'] == authorized_ids['account_id']

    # The MoneyhubProfile makes a request for an Account they don't have access to
    res = moneyhub_client.get_account(unauthorized_ids['account_id'])
    assert res.status_code == 403


@pytest.mark.jira('ACC-8348')
def test_access_check_get_account_dataloader(clean_db):
    """Test the access check for `POST /account/dataloader`."""
    authorized_ids = _setup(MONEYHUB_ACCOUNT_ID)
    unauthorized_ids = _setup(1)
    moneyhub_client = ows_abacus_account_api_client(MONEYHUB_HEADERS)

    # The MoneyhubProfile makes a request for an Account they have access to
    res = moneyhub_client.get_account_dataloader([authorized_ids['account_id']])
    assert res.status_code == 200
    assert res.json()['items'][0]['data']['account_id'] == authorized_ids['account_id']

    # The MoneyhubProfile makes a request for an Account they don't have access to
    res = moneyhub_client.get_account_dataloader([unauthorized_ids['account_id']])
    assert res.status_code == 403


@pytest.mark.jira('ACC-8348')
def test_access_check_get_payment_term_by_account_id(clean_db):
    """Test the access check for `GET /account/<account_id>/account-payment-term`."""
    authorized_ids = _setup(MONEYHUB_ACCOUNT_ID)
    unauthorized_ids = _setup(1)
    moneyhub_client = ows_abacus_account_api_client(MONEYHUB_HEADERS)

    # The MoneyhubProfile makes a request for an Account they have access to
    res = moneyhub_client.get_payment_term_by_account_id(authorized_ids['account_id'])
    assert res.status_code == 200
    assert res.json()['account_payment_term_id'] == \
        authorized_ids['account_payment_term_id']

    # The MoneyhubProfile makes a request for an Account they don't have access to
    res = moneyhub_client.get_payment_term_by_account_id(unauthorized_ids['account_id'])
    assert res.status_code == 403


@pytest.mark.jira('ACC-8348')
def test_access_check_get_payment_term_by_account_id_dataloader(clean_db):
    """Test the access check for `POST /account/account-payment-term/dataloader`."""
    authorized_ids = _setup(MONEYHUB_ACCOUNT_ID)
    unauthorized_ids = _setup(1)
    moneyhub_client = ows_abacus_account_api_client(MONEYHUB_HEADERS)

    # The MoneyhubProfile makes a request for an Account they have access to
    res = moneyhub_client.get_payment_term_by_account_id_dataloader(
        [authorized_ids['account_id']]
    )

    assert res.status_code == 200
    assert res.json()[0]['data']['account_payment_term_id'] == \
        authorized_ids['account_payment_term_id']

    # The MoneyhubProfile makes a request for an Account they don't have access to
    res = moneyhub_client.get_payment_term_by_account_id_dataloader(
        [unauthorized_ids['account_id']]
    )

    assert res.status_code == 403


@pytest.mark.jira('ACC-8348')
def test_access_check_get_account_tax_info_by_id(clean_db):
    """Test the access check for `GET /account-tax-info/<tax_info_id>`."""
    authorized_ids = _setup(MONEYHUB_ACCOUNT_ID)
    unauthorized_ids = _setup(1)
    moneyhub_client = ows_abacus_account_api_client(MONEYHUB_HEADERS)

    # The MoneyhubProfile makes a request for an Account they have access to
    res = moneyhub_client.get_account_tax_info(authorized_ids['account_tax_info_id'])

    assert res.status_code == 200
    assert res.json()['account_tax_info_id'] == authorized_ids['account_tax_info_id']

    # The MoneyhubProfile makes a request for an Account they don't have access to
    res = moneyhub_client.get_account_tax_info(unauthorized_ids['account_tax_info_id'])

    assert res.status_code == 403


@pytest.mark.jira('ACC-8348')
def test_access_check_get_account_tax_info_by_account_id(clean_db):
    """Test the access check for `GET /account/<account_id>/account-tax-info`."""
    authorized_ids = _setup(MONEYHUB_ACCOUNT_ID)
    unauthorized_ids = _setup(1)
    moneyhub_client = ows_abacus_account_api_client(MONEYHUB_HEADERS)

    # The MoneyhubProfile makes a request for an Account they have access to
    res = moneyhub_client.get_tax_info_by_account_id(
        authorized_ids['account_id']
    )

    assert res.status_code == 200
    assert res.json()['account_tax_info_id'] == authorized_ids['account_tax_info_id']

    # The MoneyhubProfile makes a request for an Account they don't have access to
    res = moneyhub_client.get_tax_info_by_account_id(
        unauthorized_ids['account_id']
    )

    assert res.status_code == 403