import uuid

import pytest
import requests
from mypy_boto3_dynamodb import DynamoDBClient

from tests.integration import config, utils
from tests.integration.conftest import seed_test_pp_identity


@pytest.mark.parametrize(
    "user_bearer_token, tenant_type, tenant_uuid",
    [
        pytest.param(
            "bearer_token_pdptest_rap_admin_user",
            "account",
            "573d0372-7f2f-48a6-8deb-c9a6558f9549",
            id="A rap admin can deactivate user from its account",
        ),
        pytest.param(
            "bearer_token_pdptest_d3_rap_admin_user",
            "subaccount",
            "ccd55b40-e10e-4059-97f0-aec665c24ec7",
            id="A rap admin for a d3 can deactivate a user from its subaccount",
        ),
    ],
)
def test_deactivate_one(
    user_bearer_token: str,
    tenant_type: str,
    tenant_uuid: str,
    default_boto_client: DynamoDBClient,
    request: pytest.FixtureRequest,
) -> None:
    """DELETE /identity/<uuid:identity_uuid>/tenant/<uuid:tenant_uuid>/deactivate/"""
    bearer_token = request.getfixturevalue(user_bearer_token)

    identity_uuid = uuid.uuid4()

    # create the identity_uuid in the database
    # so that ows-pdp check_authorization can fetch it.
    seed_test_pp_identity(
        default_boto_client,
        str(identity_uuid),
        tenant_uuid,
        "something we are deactivating",
        tenant_type=tenant_type,
    )
    url = f"{config.QA_BASE_URL}/identity/{identity_uuid}/tenant/{tenant_uuid}/deactivate/"  # noqa: E501
    response = requests.post(
        url,
        headers={"Authorization": f"Bearer {bearer_token}"},
        json={"tenant_type": tenant_type, "tenant_uuid": tenant_uuid},
    )
    assert response.status_code == 200, f"Response: {response.text}"
    assert response.json() == {
        "summary": {
            "deleted": 1,
            "remaining": 0,
        }
    }

    # Verify tombstone records
    tombstone_records = utils.fetch_tombstone_records(default_boto_client)
    assert len(tombstone_records) == 1
    assert set(tombstone_records.keys()) == {tenant_uuid}
    assert all(
        [r.get("identity_uuid").get("S", "").startswith(f"TOMBSTONE:{identity_uuid}")]
        for r in tombstone_records.values()
    )


@pytest.mark.parametrize(
    "user_bearer_token, tenant_type, tenant_uuid",
    [
        pytest.param(
            "bearer_token_pdptest_rap_admin_user",
            "account",
            "573d0372-7f2f-48a6-8deb-c9a6558f9549",
            id="""A rap admin cannot deactivate a user from
            its account if the user was never assigned to the account""",
        ),
        pytest.param(
            "bearer_token_pdptest_d3_rap_admin_user",
            "subaccount",
            "ccd55b40-e10e-4059-97f0-aec665c24ec7",
            id="""A rap admin for a d3 cannot deactivate a user from
            its subaccount if the user was never assigned to the subaccount""",
        ),
    ],
)
def test_deactivate_one_only_if_exists(
    user_bearer_token: str,
    tenant_type: str,
    tenant_uuid: str,
    default_boto_client: DynamoDBClient,
    request: pytest.FixtureRequest,
) -> None:
    """DELETE deactivate one fails when identity does not have tenant assigned."""
    bearer_token = request.getfixturevalue(user_bearer_token)

    identity_uuid = uuid.uuid4()

    url = f"{config.QA_BASE_URL}/identity/{identity_uuid}/tenant/{tenant_uuid}/deactivate/"  # noqa: E501
    response = requests.post(
        url,
        headers={"Authorization": f"Bearer {bearer_token}"},
        json={"tenant_type": tenant_type, "tenant_uuid": tenant_uuid},
    )
    assert response.status_code == 403, f"Response: {response.text}"
    assert response.json() == {
        "code": "bad_request",
        "message": "Cannot deactivate this identity/tenant",
    }


def test_deactivate_one_inconsistent_request(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_rap_admin_user: str,
) -> None:
    """Deactivate One requires tenant_uuid in path and body to match"""
    identity_uuid = uuid.uuid4()
    tenant_type = "account"
    tenant_uuid = "573d0372-7f2f-48a6-8deb-c9a6558f9549"
    # create the identity_uuid in the database
    # so that ows-pdp check_authorization can fetch it.
    seed_test_pp_identity(
        default_boto_client,
        str(identity_uuid),
        tenant_uuid,
        "something we are deactivating",
        tenant_type=tenant_type,
    )
    url = f"{config.QA_BASE_URL}/identity/{identity_uuid}/tenant/{tenant_uuid}/deactivate/"  # noqa: E501
    response = requests.post(
        url,
        headers={"Authorization": f"Bearer {bearer_token_pdptest_rap_admin_user}"},
        # tenant_uuid in body is different from the one in path
        json={"tenant_type": tenant_type, "tenant_uuid": str(uuid.uuid4())},
    )
    assert response.status_code == 400
    assert response.json() == {
        "code": "bad_request",
        "message": "Inconsistent request, tenant_uuid in path and body do not match",  # noqa: E501
    }

    # Verify tombstone records
    tombstone_records = utils.fetch_tombstone_records(default_boto_client)
    assert len(tombstone_records) == 0


def test_deactivate_one_no_authorization(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_not_rap_admin_user: str,
) -> None:
    """Deactivate One requires authorization"""
    bearer_token_identity_uuid = utils.get_bearer_token_identity_uuid(
        bearer_token_pdptest_not_rap_admin_user
    )
    pdp_test_user_uuid = "4d5f24f5-83f9-4989-9f82-0924a5feaf88"
    tenant_uuid = uuid.uuid4()

    url = f"{config.QA_BASE_URL}/identity/{pdp_test_user_uuid}/tenant/{tenant_uuid}/deactivate/"  # noqa: E501

    response = requests.post(
        url,
        headers={"Authorization": f"Bearer {bearer_token_pdptest_not_rap_admin_user}"},
        json={"tenant_type": "account", "tenant_uuid": str(tenant_uuid)},
    )
    assert response.status_code == 403, f"Response: {response.text}"
    assert response.json() == {
        "code": "bad_request",
        "message": f"Principal {bearer_token_identity_uuid} not authorized to deactivate on identity {pdp_test_user_uuid}",  # noqa: E501
    }, "NOT RAP Admin user shouldn't be authorized to deactivate."

    # Verify tombstone records
    tombstone_records = utils.fetch_tombstone_records(default_boto_client)
    assert len(tombstone_records) == 0