"""Tests for the POST /internal/v2/identities endpoint."""

import uuid

import pytest
import requests

from permissions.constants import constants, parent_companies
from tests.integration import config, utils
from tests.integration.conftest import EMPLOYEE_CREATE_BODY, EMPLOYEE_CREATE_BODY_ACCOUNT_TENANT


def test_create_employee_without_jwt() -> None:
    """Test getting internal users without a JWT."""
    headers = {
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.OWS_PERMISSIONS_VENDOR_STAR_USER_ID,
        'Orchard-Profile-Id': utils.OWS_PERMISSIONS_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    res = requests.post(
        f'{config.QA_BASE_URL}/internal/v2/identities',
        json=EMPLOYEE_CREATE_BODY,
        headers=headers,
    )

    assert res.status_code == 401
    assert res.json().get('code') == 'authorization_error'
    assert res.json().get('message') == 'Request context has no identity uuid.'


def test_create_employee_without_pp_role(
    bearer_token_user_with_vendor_star: str,
) -> None:
    """Test creating an employee without having the proper role."""
    headers = {
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Content-Type': 'application/json',
    }

    res = requests.post(
        f'{config.QA_BASE_URL}/internal/v2/identities',
        json=EMPLOYEE_CREATE_BODY,
        headers=headers,
    )

    assert res.status_code == 403


@pytest.mark.parametrize(
    'request_body',
    [
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'first_name': None},
            id='Missing first name',
        ),
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'last_name': None},
            id='Missing last name',
        ),
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'email': None},
            id='Missing email',
        ),
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'email': 'nugget@theorchard.biz'},
            id='Invalid email domain',
        ),
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'brand': '🐻‍❄️'},
            id='Invalid brand',
        ),
        pytest.param(
            {
                **EMPLOYEE_CREATE_BODY,
                'tenant': {
                    'tenant_type': 'subaccount',
                    'tenant_uuid': parent_companies.ORCHARD_PARENT_COMPANY_UUID,
                },
            },
            id='Invalid tenant type',
        ),
        pytest.param(
            {
                **EMPLOYEE_CREATE_BODY,
                'tenant': {
                    'tenant_type': constants.PARENT_COMPANY_TENANT_TYPE,
                    'tenant_uuid': 'invalid-uuid',
                },
            },
            id='Invalid tenant uuid',
        ),
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'roles_to_attach': []},
            id='Empty roles to attach',
        ),
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'roles_to_attach': ['invalid-role']},
            id='Invalid role in roles to attach',
        ),
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'email': 'a' * 65 + '@theorchard.com'},
            id='Email local part exceeds 64 characters',
        ),
        pytest.param(
            {**EMPLOYEE_CREATE_BODY, 'email': 'a' * 245 + '@theorchard.com'},
            id='Email total length exceeds 254 characters',
        ),
    ],
)
def test_create_employee_validation(seat_admin_jwt: str, request_body: dict) -> None:
    """Test creating an employee with various invalid request bodies."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
    }

    res = requests.post(
        f'{config.QA_BASE_URL}/internal/v2/identities',
        json=request_body,
        headers=headers,
    )

    assert res.status_code == 400


def test_create_employee_success(seat_admin_jwt: str, valid_create_body: dict) -> None:
    """Test creating an employee successfully."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
        # Grass headers are needed due to downstream call to ows-account
        'Orchard-Identity-Id': utils.SEAT_ADMIN_ADENTITY_ID,
        'Orchard-Profile-Id': utils.SEAT_ADMIN_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }

    res = requests.post(
        f'{config.QA_BASE_URL}/internal/v2/identities',
        json=valid_create_body,
        headers=headers,
    )

    assert res.status_code == 201
    assert 'id' in res.json()
    identity_id = res.json()['id']

    # Now try and get the new employee by email
    email = valid_create_body['email']
    res = requests.post(
        f'{config.QA_OWS_USERS_URL}/internal/user/get_by_email',
        headers=headers,
        json={'email': email},
    )

    assert res.status_code == 200
    assert res.json()['id'] == identity_id


def test_create_employee_conflict(seat_admin_jwt: str) -> None:
    """Test creating an employee that already exists."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.SEAT_ADMIN_ADENTITY_ID,
        'Orchard-Profile-Id': utils.SEAT_ADMIN_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    body = {**EMPLOYEE_CREATE_BODY, 'email': utils.OWS_PERMISSIONS_TEST_USER}

    res = requests.post(
        f'{config.QA_BASE_URL}/internal/v2/identities',
        json=body,
        headers=headers,
    )

    assert res.status_code == 409


def test_create_employee_with_invalid_role(seat_admin_jwt: str) -> None:
    """Test creating an employee with an invalid role."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.SEAT_ADMIN_ADENTITY_ID,
        'Orchard-Profile-Id': utils.SEAT_ADMIN_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    randomness = str(uuid.uuid4()).replace('-', '')[:12]
    body = {
        **EMPLOYEE_CREATE_BODY_ACCOUNT_TENANT,
        'email': f'account-access-{randomness}@theorchard.com',
        'tenant': {
            'tenant_type': constants.ACCOUNT_TENANT_TYPE,
            'tenant_uuid': 'b06a1715-ed75-4cfb-9aae-965040da1b15',  # Test KNR - 1
        },
    }

    res = requests.post(
        f'{config.QA_BASE_URL}/internal/v2/identities',
        json=body,
        headers=headers,
    )

    assert res.status_code == 422


def test_create_employee_with_account_access(seat_admin_jwt: str) -> None:
    """Test creating an employee with account access."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.SEAT_ADMIN_ADENTITY_ID,
        'Orchard-Profile-Id': utils.SEAT_ADMIN_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    randomness = str(uuid.uuid4()).replace('-', '')[:12]
    body = {
        **EMPLOYEE_CREATE_BODY_ACCOUNT_TENANT,
        'email': f'account-access-{randomness}@theorchard.com',
    }

    res = requests.post(
        f'{config.QA_BASE_URL}/internal/v2/identities',
        json=body,
        headers=headers,
    )
    assert 'id' in res.json()
    identity_id = res.json()['id']

    # Now try and get the new employee by email
    email = body['email']
    res = requests.post(
        f'{config.QA_OWS_USERS_URL}/internal/user/get_by_email',
        headers=headers,
        json={'email': email},
    )

    assert res.status_code == 200
    assert res.json()['id'] == identity_id