from __future__ import annotations

from dataclasses import dataclass
from typing import Any

import httpx
from jwtauth.utils import jwt_auth_from_environment
from secrets_manager.python_ext import PythonSecretsManager

from tests.integration.config import (
    AUTH0_PDP_TEST_APP_CLIENT_ID,
    AUTH0_PDP_TEST_APP_CLIENT_SECRET,
    AUTH_AUDIENCE,
    AUTH_URL,
    CLAIM_ORCHARD_IDENTITY_ID,
    JWT_USER_METADATA,
)
from tests.integration.dtos import TestUser
from tests.integration.users import TEST_USERS


@dataclass
class LoginInfo:
    """Holds auth0 login info."""

    username: str
    password: str
    auth_client_id: str
    auth_client_secret: str


def decode_token(token: str) -> dict[str, Any]:
    """Extract claims from token."""
    auth = jwt_auth_from_environment(environment="qa")
    return auth.get_token(token)


def login_with_email(email: str, password: str) -> LoginInfo:
    """Create LoginInfo from direct email and fixed password."""
    secrets_manager_client = PythonSecretsManager()
    auth_client_id = secrets_manager_client.get_secret(AUTH0_PDP_TEST_APP_CLIENT_ID)
    auth_client_secret = secrets_manager_client.get_secret(
        AUTH0_PDP_TEST_APP_CLIENT_SECRET
    )

    return LoginInfo(
        username=email,
        password=password,
        auth_client_id=auth_client_id,
        auth_client_secret=auth_client_secret,
    )


def generate_auth_token(login_info: LoginInfo) -> str:
    """Generate Auth0 token for pdp test user."""
    data = {
        "grant_type": "password",
        "username": login_info.username,
        "password": login_info.password,
        "audience": AUTH_AUDIENCE,
        "scope": "",
        "client_id": login_info.auth_client_id,
        "client_secret": login_info.auth_client_secret,
    }

    r = httpx.post(AUTH_URL, data=data)
    resp = r.json()

    if "error" in resp:
        raise ValueError(f"Auth0 error occurred:  {resp}")

    return resp["access_token"] or ""


def get_identity_uuid(decoded_jwt: dict[str, Any]) -> str | None:
    """Get a user's orchardIdentityId from a decoded JWT."""
    identity_uuid = None
    grass_data = decoded_jwt.get(JWT_USER_METADATA)
    if grass_data:
        identity_uuid = grass_data.get(CLAIM_ORCHARD_IDENTITY_ID)
    return identity_uuid


def get_user_email(user_name: TestUser) -> str:
    return TEST_USERS[user_name].email