"""Integration tests for GET /identity/{identity_uuid}/roles endpoint."""

from uuid import uuid4

import pytest
import requests
from mypy_boto3_dynamodb import DynamoDBClient

from tests.integration import config, utils
from tests.integration.api.identity.helpers import (
    assert_get_identity_roles,
    assert_get_identity_roles_empty,
)
from tests.integration.conftest import seed_test_pp_identity


def test_get_roles_by_identity_empty(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_user: str,
    bearer_token_pdptest_user_identity_uuid: str,
) -> None:
    """GET /identity/{identity_uuid}/roles/ endpoint (empty database)."""
    url = f"{config.QA_BASE_URL}/identity/{bearer_token_pdptest_user_identity_uuid}/roles/"  # noqa: E501
    assert_get_identity_roles_empty(url=url, bearer_token=bearer_token_pdptest_user)


def test_get_roles_by_identity(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_user: str,
    bearer_token_pdptest_user_identity_uuid: str,
) -> None:
    """GET /identity/{identity_uuid}/roles/ endpoint."""
    url = f"{config.QA_BASE_URL}/identity/{bearer_token_pdptest_user_identity_uuid}/roles/"  # noqa: E501
    assert_get_identity_roles(
        url,
        default_boto_client,
        bearer_token_pdptest_user,
        bearer_token_pdptest_user_identity_uuid,
    )


def test_get_roles_by_identity_invalid_token(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_user_identity_uuid: str,
) -> None:
    """GET /identity/{identity_uuid}/roles/ endpoint fails with invalid jwt."""
    url = f"{config.QA_BASE_URL}/identity/{bearer_token_pdptest_user_identity_uuid}/roles/"  # noqa: E501
    response = requests.get(url, headers={"Authorization": "Bearer no.such.token"})

    assert response.status_code == 401, f"Response: {response.text}"


@pytest.mark.parametrize(
    "user_bearer_token, status_code",
    [
        pytest.param(
            "bearer_token_pdptest_rap_admin_user",
            200,
            id="rap admin user should be able to list tenants",
        ),
        pytest.param(
            "bearer_token_pdptest_not_rap_admin_user",
            403,
            id="non-rap admin user should not be able to list tenants",
        ),
    ],
)
def test_get_roles_by_identity_rap_admin(
    default_boto_client: DynamoDBClient,
    user_bearer_token: str,
    status_code: int,
    request: pytest.FixtureRequest,
) -> None:
    """Verify rap admin users can make this request."""
    bearer_token = request.getfixturevalue(user_bearer_token)
    bearer_token_identity_uuid = utils.get_bearer_token_identity_uuid(bearer_token)
    pdp_test_user_uuid = "4d5f24f5-83f9-4989-9f82-0924a5feaf88"
    url = f"{config.QA_BASE_URL}/identity/{pdp_test_user_uuid}/roles/"

    response = requests.get(url, headers={"Authorization": f"Bearer {bearer_token}"})
    assert response.status_code == status_code, f"Response: {response.text}"
    if status_code == 401:
        assert response.json() == {
            "code": "bad_request",
            "message": f"Principal {bearer_token_identity_uuid} not authorized to list_tenants on identity {pdp_test_user_uuid}",  # noqa: E501
        }, response.text


def test_check_resources_as_rap_admin_in_hierarchy(
    default_boto_client: DynamoDBClient,
    bearer_token_pdptest_d3_rap_admin_user: str,
) -> None:
    """Verify a D3 RAP Admin can view an Identity with roles under subaccounts."""
    # Use D3 RAP Admin of Distribution Inc test D3 as the Principal making requests

    target_identity_uuid_str = str(uuid4())
    fat_wreck_tenant_uuid_str = "ccd55b40-e10e-4059-97f0-aec665c24ec7"
    # Assign Fat Wreck Records Text Tenant
    # which is owned by the Distribution Inc test D3
    seed_test_pp_identity(
        boto_client=default_boto_client,
        identity_uuid=target_identity_uuid_str,
        tenant_uuid=fat_wreck_tenant_uuid_str,  # Fat Wreck Records Text
        role="some_role",
        tenant_type="subaccount",
    )
    # Assign Luondu Music subaccount
    # which is NOT owned by the Distribution Inc test D3
    seed_test_pp_identity(
        boto_client=default_boto_client,
        identity_uuid=target_identity_uuid_str,
        tenant_uuid="e369934b-36fb-4ca9-b2bd-4adecc6a8ccc",
        role="some_role",
        tenant_type="subaccount",
    )

    url = f"{config.QA_BASE_URL}/identity/{target_identity_uuid_str}/roles/"
    response = requests.get(
        url,
        headers={"Authorization": f"Bearer {bearer_token_pdptest_d3_rap_admin_user}"},
    )  # noqa: E501
    assert response.status_code == 200, f"Response: {response.text}"
    # Only roles for fat_wreck_tenant_uuid_str should be returned
    # Luondu roles should NOT be returned
    assert response.json() == {
        "cursor": {"cursor": None, "shorthand": None},
        "errors": {},
        "tenants": {
            fat_wreck_tenant_uuid_str: {
                "roles": [{"role": "some_role"}],
                "tenant_type": "subaccount",
                "tenant_uuid": fat_wreck_tenant_uuid_str,
            }
        },
    }