"""Tests for the PDP authorization module."""

from unittest import mock
from unittest.mock import MagicMock, patch

from account.utils import authorization


@patch('account.utils.authorization.base')
@patch('account.utils.authorization.config')
def test_pdp_authorize_manage_employee(
    config_mock: MagicMock,
    resource_getters_base_mock: MagicMock,
) -> None:
    """Test the pdp_authorize_manage_employee function."""
    config_mock.pdp_authorization_backend.is_authorized.return_value = True

    result = authorization.pdp_authorize_manage_employee()

    assert result is True
    config_mock.pdp_authorization_backend.is_authorized.assert_called_once_with(
        action='manage_employee',
        resource_id=0,
        resource_type='identity',
        resource_getter=resource_getters_base_mock.ForwardKwargsGetter.return_value,
        identity_uuid=mock.ANY,
    )


@patch('account.utils.authorization.g', spec=['log', 'request_context'])
@patch('account.utils.authorization.base')
@patch('account.utils.authorization.config')
def test_pdp_authorize_manage_employee_unauthorized(
    config_mock: MagicMock,
    _resource_getters_base_mock: MagicMock,
    g_mock: MagicMock,
) -> None:
    """Test the pdp_authorize_manage_employee function."""
    g_mock.request_context = MagicMock(jwt_identity_id='identity-id')
    config_mock.pdp_authorization_backend.is_authorized.return_value = False

    result = authorization.pdp_authorize_manage_employee()

    assert result is False
    g_mock.log.warn.assert_called_once_with(
        'authorization_error',
        resources={
            'identity_id': 'identity-id',
            'resource_id': 0,
            'resource_type': 'identity',
            'auth_response': False,
        },
    )


@patch('account.utils.authorization.base')
@patch('account.utils.authorization.config')
def test_pdp_authorize_list_parent_companies(
    config_mock: MagicMock,
    resource_getters_base_mock: MagicMock,
) -> None:
    """Test the pdp_authorize_list_parent_companies function."""
    config_mock.pdp_authorization_backend.is_authorized.return_value = True

    result = authorization.pdp_authorize_list_parent_companies()

    assert result is True
    config_mock.pdp_authorization_backend.is_authorized.assert_called_once_with(
        action='list',
        resource_id=0,
        resource_type='parent_company',
        resource_getter=resource_getters_base_mock.ForwardKwargsGetter.return_value,
    )


@patch('account.utils.authorization.g', spec=['log', 'request_context'])
@patch('account.utils.authorization.base')
@patch('account.utils.authorization.config')
def test_pdp_authorize_list_parent_companies_unauthorized(
    config_mock: MagicMock,
    _resource_getters_base_mock: MagicMock,
    g_mock: MagicMock,
) -> None:
    """Test the pdp_authorize_list_parent_companies function."""
    g_mock.request_context = MagicMock(jwt_identity_id='identity-id')
    config_mock.pdp_authorization_backend.is_authorized.return_value = False

    result = authorization.pdp_authorize_list_parent_companies()

    assert result is False
    g_mock.log.warn.assert_called_once_with(
        'authorization_error',
        resources={
            'identity_id': 'identity-id',
            'resource_id': 0,
            'resource_type': 'parent_company',
            'auth_response': False,
        },
    )