"""Test DELETE /v2/subaccounts/<subaccount_uuid>."""

import time

import pytest
import requests

from tests.integration import config
from tests.integration.consts import vendors


@pytest.fixture()
def theorchard_subaccount_attrs() -> dict:
    return {
        'subaccount_name': f'ows-account integration-test delete sme {time.time()}',
        'description': 'ows-account-integration-test-delete',
        'country_id': 1,
        'subaccount_split_type': 'Net',
        'vendor_id': vendors.THRITYTIGERS_VENDOR_ID,
    }


@pytest.mark.parametrize(
    'create_token_fixture,delete_token_fixture,expected_status',
    [
        pytest.param(
            'bearer_token_account_admin_theorchard',
            'bearer_token_account_admin_theorchard',
            200,
            id='account admin can delete a subaccount',
        ),
        pytest.param(
            'bearer_token_contract_admin_theorchard',
            'bearer_token_contract_admin_theorchard',
            403,
            id='contract admin cannot delete a subaccount',
        ),
    ],
)
def test_v2_delete_subaccount(
    request: pytest.FixtureRequest,
    create_token_fixture: str,
    delete_token_fixture: str,
    theorchard_subaccount_attrs: dict,
    expected_status: int,
) -> None:
    """Test DELETE /v2/subaccounts/<subaccount_uuid> authorization scenarios."""
    create_token = request.getfixturevalue(create_token_fixture)
    delete_token = request.getfixturevalue(delete_token_fixture)

    create_response = requests.post(
        f'{config.QA_BASE_URL}/v2/subaccounts',
        json=theorchard_subaccount_attrs,
        headers={'Authorization': f'Bearer {create_token}'},
    )
    assert create_response.status_code == 200, create_response.text
    subaccount_uuid = create_response.json()['subaccount_uuid']

    delete_response = requests.delete(
        f'{config.QA_BASE_URL}/v2/subaccounts/{subaccount_uuid}',
        headers={'Authorization': f'Bearer {delete_token}'},
    )
    assert delete_response.status_code == expected_status, delete_response.text

    if expected_status == 200:
        assert delete_response.json()['subaccount_uuid'] == subaccount_uuid
    else:
        assert delete_response.json() == {'code': 'authorization_error', 'message': 'Forbidden'}


def test_v2_delete_subaccount_not_found(bearer_token_account_admin_theorchard: str) -> None:
    """Test DELETE /v2/subaccounts/<subaccount_uuid> returns 403 for unknown UUID.

    PDP cannot resolve tenant attributes for a non-existent UUID, so authorization
    is denied before the model layer is reached.
    """
    response = requests.delete(
        f'{config.QA_BASE_URL}/v2/subaccounts/00000000-0000-0000-0000-000000000000',
        headers={'Authorization': f'Bearer {bearer_token_account_admin_theorchard}'},
    )
    assert response.status_code == 403, response.text


def test_v2_delete_subaccount_already_deleted(
    bearer_token_account_admin_theorchard: str,
    theorchard_subaccount_attrs: dict,
) -> None:
    """Test DELETE /v2/subaccounts/<subaccount_uuid> is idempotent."""
    create_response = requests.post(
        f'{config.QA_BASE_URL}/v2/subaccounts',
        json=theorchard_subaccount_attrs,
        headers={'Authorization': f'Bearer {bearer_token_account_admin_theorchard}'},
    )
    assert create_response.status_code == 200, create_response.text
    subaccount_uuid = create_response.json()['subaccount_uuid']

    delete_response = requests.delete(
        f'{config.QA_BASE_URL}/v2/subaccounts/{subaccount_uuid}',
        headers={'Authorization': f'Bearer {bearer_token_account_admin_theorchard}'},
    )
    assert delete_response.status_code == 200, delete_response.text

    second_delete_response = requests.delete(
        f'{config.QA_BASE_URL}/v2/subaccounts/{subaccount_uuid}',
        headers={'Authorization': f'Bearer {bearer_token_account_admin_theorchard}'},
    )
    assert second_delete_response.status_code == 200, second_delete_response.text
    assert second_delete_response.json()['subaccount_uuid'] == subaccount_uuid