"""Integration tests for POSt /identity/self/allowed-tenants/."""

from typing import Any, Dict, List

import pytest
import requests
from mypy_boto3_dynamodb import DynamoDBClient

from pdp.connectors.dynamo import DynamoDbConnector
from tests.integration import config
from tests.integration.conftest import seed_test_pp_identity


@pytest.mark.parametrize(
    "seed_role, request_body, expected_response",
    [
        pytest.param(
            "audience_development_analyst",
            {"action": "view", "resource_type": "audience"},
            {
                "action": "view",
                "resource_type": "audience",
                "tenants": [
                    {
                        "tenant_id": 7123,
                        "tenant_type": "account",
                        "tenant_uuid": "573d0372-7f2f-48a6-8deb-c9a6558f9549",
                    },
                ],
            },
            id="seeded user has exactly one valid tenant to view tenants",
        ),
        pytest.param(
            "audience_development_analyst",
            {"action": "create", "resource_type": "audience"},
            {"action": "create", "resource_type": "audience", "tenants": []},
            id="seeded user has no tenants to create audiences for",
        ),
        pytest.param(
            "audience_development_analyst",
            {"action": "view", "resource_type": "signing_entity"},
            {"action": "view", "resource_type": "signing_entity", "tenants": []},
            id="""no-schema resource works and
            audience-development_admin has no tenants for view signing_entity""",
        ),
        pytest.param(
            "contract_admin",
            {"action": "view", "resource_type": "signing_entity"},
            {
                "action": "view",
                "resource_type": "signing_entity",
                "tenants": [
                    {
                        "tenant_id": 7123,
                        "tenant_type": "account",
                        "tenant_uuid": "573d0372-7f2f-48a6-8deb-c9a6558f9549",
                    },
                    {
                        "tenant_id": 778603,
                        "tenant_type": "account",
                        "tenant_uuid": "902b8778-e09a-11ee-a7c1-12b0989b795f",
                    },
                ],
            },
            id="""no-schema resource works and
            contract_admin has all tenants for view signing_entity""",
        ),
    ],
)
def test_check_my_allowed_tenants(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_user: str,
    bearer_token_pdptest_user_identity_uuid: str,
    seed_role: str,
    request_body: Dict[str, List[Any]],
    expected_response: Dict[str, List[Any]],
) -> None:
    """POST /identity/self/allowed-tenants/ endpoint."""
    seed_test_pp_identity(
        default_boto_client,
        bearer_token_pdptest_user_identity_uuid,
        "573d0372-7f2f-48a6-8deb-c9a6558f9549",
        seed_role,
    )
    seed_test_pp_identity(
        default_boto_client,
        bearer_token_pdptest_user_identity_uuid,
        "902b8778-e09a-11ee-a7c1-12b0989b795f",
        "random_role",
    )
    response = requests.post(
        f"{config.QA_BASE_URL}/identity/self/allowed-tenants/",
        json=request_body,
        headers={"Authorization": f"Bearer {bearer_token_pdptest_user}"},
    )
    assert response.json() == expected_response


@pytest.mark.parametrize(
    "seed_tenant_type, seed_tenant_uuid, request_body, expected_response",
    [
        pytest.param(
            "company_brand",
            "d25a4cd1-e820-45f2-be5c-56edcfeb8298",
            {"action": "view", "resource_type": "account"},
            {
                "action": "view",
                "resource_type": "account",
                "tenants": [
                    {
                        "tenant_id": 2,
                        "tenant_type": "company_brand",
                        "tenant_uuid": "d25a4cd1-e820-45f2-be5c-56edcfeb8298",
                    },
                ],
            },
            id="company brand with id is returned as allowed tenant",
        ),
        pytest.param(
            "parent_company",
            "f1594122-7f99-4916-b103-08b0444c7b46",
            {"action": "view", "resource_type": "account"},
            {
                "action": "view",
                "resource_type": "account",
                "tenants": [
                    {
                        "tenant_id": None,
                        "tenant_type": "parent_company",
                        "tenant_uuid": "f1594122-7f99-4916-b103-08b0444c7b46",
                    },
                ],
            },
            id="parent_company, without id is returned as allowed tenant",
        ),
    ],
)
def test_check_my_allowed_tenants_for_different_tenant_types(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_user: str,
    bearer_token_pdptest_user_identity_uuid: str,
    seed_tenant_type: str,
    seed_tenant_uuid: str,
    request_body: Dict[str, List[Any]],
    expected_response: Dict[str, List[Any]],
) -> None:
    """POST /identity/self/allowed-tenants/ endpoint for different tenant types."""
    seed_test_pp_identity(
        default_boto_client,
        bearer_token_pdptest_user_identity_uuid,
        seed_tenant_uuid,
        "contract_viewer",
        tenant_type=seed_tenant_type,
    )
    seed_test_pp_identity(
        default_boto_client,
        bearer_token_pdptest_user_identity_uuid,
        "902b8778-e09a-11ee-a7c1-12b0989b795f",
        "random_role",
    )
    response = requests.post(
        f"{config.QA_BASE_URL}/identity/self/allowed-tenants/",
        json=request_body,
        headers={"Authorization": f"Bearer {bearer_token_pdptest_user}"},
    )
    assert response.json() == expected_response


def test_check_my_allowed_tenants__no_tenants(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_user: str,
    local_dynamo_connector: DynamoDbConnector,
) -> None:
    """/identity/self/allowed-tenants/ with a machine with 0 tenants"""
    # Sanity check that the pdptest user does not have any roles attached
    # in the integration test db.
    result = local_dynamo_connector.query_by_hash_key(
        "4d5f24f5-83f9-4989-9f82-0924a5feaf88"
    )
    items = result.get("items", [])
    print(f"items {items}")
    assert len(items) == 0

    response = requests.post(
        f"{config.QA_BASE_URL}/identity/self/allowed-tenants/",
        json={"action": "list_tenants", "resource_type": "identity"},
        headers={"Authorization": f"Bearer {bearer_token_pdptest_user}"},
    )

    assert response.json() == {
        "action": "list_tenants",
        "resource_type": "identity",
        "tenants": [],
    }
    assert response.status_code == 200