"""Tests for the DELETE /internal/v2/identities/<id>/tenants/<type>/<uuid> endpoint."""

import uuid

import requests

from tests.integration import config, utils
from tests.integration.conftest import EMPLOYEE_CREATE_BODY_ACCOUNT_TENANT

# Platform Test Vendor account tenant used by EMPLOYEE_CREATE_BODY_ACCOUNT_TENANT.
ACCOUNT_TENANT_UUID = '2e79b9b8-29ed-44e1-832f-2aa3b47f13c8'


def test_revoke_employee_tenant_access_without_jwt() -> None:
    """Test revoking employee tenant access without a JWT."""
    headers = {
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.OWS_PERMISSIONS_VENDOR_STAR_USER_ID,
        'Orchard-Profile-Id': utils.OWS_PERMISSIONS_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    res = requests.delete(
        f'{config.QA_BASE_URL}/internal/v2/identities/{utils.TEST_EMPLOYEE_USER_ID}'
        f'/tenants/account/{ACCOUNT_TENANT_UUID}',
        headers=headers,
    )

    assert res.status_code == 401
    assert res.json().get('code') == 'authorization_error'
    assert res.json().get('message') == 'Request context has no identity uuid.'


def test_revoke_employee_tenant_access_without_pp_role(
    bearer_token_user_with_vendor_star: str,
) -> None:
    """Test revoking employee tenant access without the manage_employee role."""
    headers = {
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Content-Type': 'application/json',
    }

    res = requests.delete(
        f'{config.QA_BASE_URL}/internal/v2/identities/{utils.TEST_EMPLOYEE_USER_ID}'
        f'/tenants/account/{ACCOUNT_TENANT_UUID}',
        headers=headers,
    )

    assert res.status_code == 403


def test_revoke_employee_tenant_access_non_account_tenant(seat_admin_jwt: str) -> None:
    """Test that only the account tenant type is accepted."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
    }

    res = requests.delete(
        f'{config.QA_BASE_URL}/internal/v2/identities/{utils.TEST_EMPLOYEE_USER_ID}'
        f'/tenants/parent_company/{ACCOUNT_TENANT_UUID}',
        headers=headers,
    )

    assert res.status_code == 400
    assert res.json().get('code') == 'validation_error'


def test_revoke_employee_tenant_access_tenant_not_found(
    seat_admin_jwt: str, new_employee_id: str
) -> None:
    """Test revoking access to a non-existent account tenant returns 404."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
    }

    res = requests.delete(
        f'{config.QA_BASE_URL}/internal/v2/identities/{new_employee_id}'
        '/tenants/account/00000000-0000-0000-0000-000000000000',
        headers=headers,
    )

    assert res.status_code == 404
    assert res.json().get('message') == 'Tenant not found.'


def test_revoke_employee_tenant_access_success(seat_admin_jwt: str) -> None:
    """Revoke an employee's only account tenant; the employee stays active."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
        # Grass headers are needed due to downstream call to ows-account
        'Orchard-Identity-Id': utils.SEAT_ADMIN_ADENTITY_ID,
        'Orchard-Profile-Id': utils.SEAT_ADMIN_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    randomness = str(uuid.uuid4()).replace('-', '')[:12]
    create_body = {
        **EMPLOYEE_CREATE_BODY_ACCOUNT_TENANT,
        'email': f'ows-permissions-integration-test-employee_{randomness}@theorchard.com',
    }

    # Create an employee whose only tenant is the account tenant.
    res = requests.post(
        f'{config.QA_BASE_URL}/internal/v2/identities',
        json=create_body,
        headers=headers,
    )
    assert res.status_code == 201
    identity_id = res.json()['id']

    # Revoke access to that account tenant.
    res = requests.delete(
        f'{config.QA_BASE_URL}/internal/v2/identities/{identity_id}'
        f'/tenants/account/{ACCOUNT_TENANT_UUID}',
        headers=headers,
    )
    assert res.status_code == 204

    # Even though it was the last tenant, the identity should remain active.
    res = requests.get(
        f'{config.QA_OWS_USERS_URL}/users/identity/{identity_id}',
        headers=headers,
    )
    assert res.json()['active'] == 'Y'