"""Tests for authorizing many accounts."""

from unittest.mock import MagicMock, patch

import pytest
from python_pdp_sdk import (
    ResourceWithAttributes,
)
from python_pdp_sdk.backends import exceptions

from abacus_account.utils.authorization import authorize_many_accounts


@pytest.mark.parametrize(
    'auth_response,expected_result',
    [
        pytest.param([True, False], False, id='partial access, expect False'),
        pytest.param([True, True], True, id='full access, expect True'),
        pytest.param([False, False], False, id='no access, expect False'),
        pytest.param([True], False, id='length mismatch, expect False'),
    ],
)
@patch('abacus_account.utils.authorization.authorization_backend')
@patch('abacus_account.utils.authorization.g')
def test_authorize_accounts(
    mock_g: MagicMock,
    mock_authorization_backend: MagicMock,
    auth_response: list[bool],
    expected_result: bool,
) -> None:
    """Test authorize_many_accounts."""
    account_ids = [1234, 5678]

    mock_authorization_backend.is_authorized_many.return_value = auth_response
    result = authorize_many_accounts(account_ids)

    assert result == expected_result

    mock_authorization_backend.is_authorized_many.assert_called_once_with(
        action='view_abacus_account_info',
        resource_type='account',
        resources_with_attributes=[
            ResourceWithAttributes(
                resource_id=1234,
                attributes={
                    'tenant': {'tenant_type': 'account'},
                    'id_to_uuid_exchange_tenant': {
                        'tenant_type': 'account',
                        'tenant_id': 1234,
                    }
                },
            ),
            ResourceWithAttributes(
                resource_id=5678,
                attributes={
                    'tenant': {'tenant_type': 'account'},
                    'id_to_uuid_exchange_tenant': {
                        'tenant_type': 'account',
                        'tenant_id': 5678,
                    }
                },
            ),
        ],
    )

    if not result:
        mock_g.log.warn.assert_called_once_with(
            'Unauthorized to access many accounts',
            resources={
                'identity_id': mock_g.request_context.jwt_identity_id,
                'account_ids': account_ids,
                'auth_response': auth_response
            }
        )
    else:
        mock_g.log.warn.assert_not_called()


def test_action_is_passed_to_authorize_many_accounts():
    """Test that the action is passed to authorize_many_accounts."""
    account_ids = [1234, 5678]
    action = 'view_something'

    with (patch('abacus_account.utils.authorization.authorization_backend')
          as mock_authorization_backend):
        authorize_many_accounts(account_ids, action)

    mock_authorization_backend.is_authorized_many.assert_called_once_with(
        action=action,
        resource_type='account',
        resources_with_attributes=[
            ResourceWithAttributes(
                resource_id=1234,
                attributes={
                    'tenant': {'tenant_type': 'account'},
                    'id_to_uuid_exchange_tenant': {
                        'tenant_type': 'account',
                        'tenant_id': 1234,
                    }
                },
            ),
            ResourceWithAttributes(
                resource_id=5678,
                attributes={
                    'tenant': {'tenant_type': 'account'},
                    'id_to_uuid_exchange_tenant': {
                        'tenant_type': 'account',
                        'tenant_id': 5678,
                    }
                },
            ),
        ],
    )


@patch('abacus_account.utils.authorization.authorization_backend')
@patch('abacus_account.utils.authorization.g')
def test_pdp_authorize_many_accounts_error(
    mock_g: MagicMock, mock_authorization_backend: MagicMock
) -> None:
    """Test error handling of pdp_authorize_many_accounts."""
    mock_authorization_backend.is_authorized_many.side_effect = \
        exceptions.InvalidRequestException('🥶')
    account_ids = [1234, 5678]

    result = authorize_many_accounts(account_ids=account_ids)

    assert result is False
    mock_g.log.warn.assert_called_with(
        'Caught a PDP InvalidRequestException',
        resources={
            'identity_id': mock_g.request_context.jwt_identity_id,
            'resource_ids': account_ids,
            'resource_type': 'account',
            'error': '🥶',
        }
    )