"""Tests for authorizing accounts."""

from typing import Type
from unittest.mock import MagicMock, patch

import pytest
from python_pdp_sdk.backends.exceptions import AttributesException

from ledger.constants import error
from ledger.utils.authorization import pdp_authorize_resource


@pytest.mark.parametrize(
    'auth_response, expected_result',
    [
        pytest.param(True, True, id='A true auth response should return `True`'),
        pytest.param(False, False, id='A false auth response should return `False`'),
    ],
)
@patch('ledger.utils.authorization.ForwardKwargsGetter')
@patch('ledger.utils.authorization.authorization_backend')
@patch('ledger.utils.authorization.g')
def test_pdp_authorize_resource(
    mock_g: MagicMock,
    mock_authorization_backend: MagicMock,
    mock_getter: MagicMock,
    auth_response: bool,
    expected_result: bool,
) -> None:
    """Test pdp_authorize_resource."""
    account_id = 1
    action = 'view_abacus_account_info'
    resource_type = 'account'
    tenant_type = 'account'

    mock_getter_instance = mock_getter.return_value
    mock_authorization_backend.is_authorized.return_value = auth_response

    result = pdp_authorize_resource(
        account_id=account_id,
        action=action,
    )

    assert result == expected_result
    mock_authorization_backend.is_authorized.assert_called_with(
        action,
        account_id,
        resource_type,
        mock_getter_instance,
        tenant={
            'tenant_type': tenant_type,
        },
        id_to_uuid_exchange_tenant={
            'tenant_type': tenant_type,
            'tenant_id': account_id,
        },
    )

    if not auth_response:
        mock_g.log.warn.assert_called_once_with(
            error.ERROR_CODE_UNAUTHORIZED_ACCOUNT,
            resources={
                'identity_id': mock_g.request_context.jwt_identity_id,
                'account_id': account_id,
                'auth_response': auth_response,
            },
        )
    else:
        mock_g.log.warn.assert_not_called()


@pytest.mark.parametrize(
    'raised_exception_type, expect_raises',
    [
        pytest.param(
            AttributesException,
            False,
            id='Test pdp_authorize_resource return False for an AttributesException.',
        ),
        pytest.param(
            RuntimeError,
            True,
            id='Test pdp_authorize_resource raise an error for an unknown error.',
        ),
    ],
)
@patch('ledger.utils.authorization.ForwardKwargsGetter')
@patch('ledger.utils.authorization.authorization_backend')
@patch('ledger.utils.authorization.g')
def test_pdp_authorize_resource__attributes_error(
    mock_g: MagicMock,
    mock_authorization_backend: MagicMock,
    mock_getter: MagicMock,
    raised_exception_type: Type[Exception],
    expect_raises: bool,
) -> None:
    """Test pdp_authorize_resource with raised errors."""
    account_id = 1
    action = 'view_abacus_account_info'
    resource_type = 'account'
    tenant_type = 'account'

    mock_getter_instance = mock_getter.return_value
    mock_authorization_backend.is_authorized.side_effect = [
        raised_exception_type('error')
    ]

    if expect_raises:
        with pytest.raises(raised_exception_type):
            _ = pdp_authorize_resource(
                account_id=account_id,
                action=action,
            )
    else:
        result = pdp_authorize_resource(
            account_id=account_id,
            action=action,
        )
        mock_g.log.warn.assert_called_once_with(
            'PP raised an AttributesException: error',
            resources={
                'identity_id': mock_g.request_context.jwt_identity_id,
                'account_id': account_id,
            },
        )

        assert result is False

    mock_authorization_backend.is_authorized.assert_called_with(
        action,
        account_id,
        resource_type,
        mock_getter_instance,
        tenant={
            'tenant_type': tenant_type,
        },
        id_to_uuid_exchange_tenant={
            'tenant_type': tenant_type,
            'tenant_id': account_id,
        },
    )