"""Integration tests for POST /cache/bludgeon/."""

from typing import Any, Dict, List

import pytest
import requests

from pdp.connectors.redis_client import RedisConnector
from pdp.constants.constants import CACHE_ENTRY_CERBOS_POLICY_METADATA
from tests.integration import config
from tests.integration.utils import get_bearer_token_identity_uuid

# check_authorization_infra reads this key (seeded by
# autouse_seed_policy_metadata_cache), so it's always present alongside the
# test's own cache entries and counts toward dbsize().
CERBOS_POLICY_METADATA_KEY = CACHE_ENTRY_CERBOS_POLICY_METADATA.encode()


@pytest.mark.parametrize(
    "body, expected_status_code, expected_response, expected_remaining_keys",
    [
        pytest.param(
            {"cache_entry_type": "tenant_hierarchy", "delete": True},
            200,
            {
                "total_rows_before_delete": 4,
                "total_rows_affected": 2,
                "performed_delete": True,
            },
            [b"key1", CERBOS_POLICY_METADATA_KEY],
            id="cache_bludgeon should delete the tenant_hierarchy entries when delete=True.",  # noqa: E501
        ),
        pytest.param(
            {"cache_entry_type": "tenant_hierarchy", "delete": False},
            200,
            {
                "total_rows_before_delete": 4,
                "total_rows_affected": 2,
                "performed_delete": False,
            },
            [
                b"key1",
                b"tenant_hierarchy_fff741c2-6def-4493-bfdf-c2bcb1128e02",
                b"tenant_hierarchy_45125167-d387-4e84-a899-f11543f22dfb",
                CERBOS_POLICY_METADATA_KEY,
            ],
            id="cache_bludgeon should not delete tenant_hierarchy entries when delete=False.",  # noqa: E501
        ),
    ],
)
async def test_cache_bludgeon(
    bearer_token_pdptest_user: str,
    local_redis_connector: RedisConnector,
    body: Dict[str, Any],
    expected_status_code: int,
    expected_response: Dict[str, Any],
    expected_remaining_keys: List[bytes],
) -> None:
    """POST /cache/bludgeon/ endpoint."""
    url = f"{config.QA_BASE_URL}/cache/bludgeon/"
    headers = {"Authorization": f"Bearer {bearer_token_pdptest_user}"}

    # Set up the test data
    test_key_values = {
        "tenant_hierarchy_fff741c2-6def-4493-bfdf-c2bcb1128e02": '{"key": "value"}',
        "tenant_hierarchy_45125167-d387-4e84-a899-f11543f22dfb": "a string value",
        "key1": "value1",
    }
    await local_redis_connector.client.mset(test_key_values)

    response = requests.post(url, json=body, headers=headers)

    assert response.status_code == expected_status_code, f"Response: {response.text}"
    assert response.json() == expected_response, response.text

    remaining_keys = await local_redis_connector.client.keys("*")
    assert set(remaining_keys) == set(expected_remaining_keys)


async def test_cache_bludgeon_unauthorized(
    bearer_token_pdptest_rap_admin_user: str,
) -> None:
    """POST /cache/bludgeon/ endpoint with unauthorized user token."""
    url = f"{config.QA_BASE_URL}/cache/bludgeon/"
    principal_uuid = get_bearer_token_identity_uuid(bearer_token_pdptest_rap_admin_user)
    headers = {"Authorization": f"Bearer {bearer_token_pdptest_rap_admin_user}"}
    body = {"cache_entry_type": "tenant_hierarchy", "delete": False}

    response = requests.post(url, json=body, headers=headers)
    assert response.status_code == 403, f"Response: {response.text}"
    assert response.json() == {
        "code": "bad_request",
        "message": f"Principal {principal_uuid} not authorized to bludgeon_cache.",
    }