"""Tests for the PATCH /internal/v2/identities/<identity id> endpoint."""

import pytest
import requests

from permissions.constants import application, constants, parent_companies
from tests.integration import config, utils

VALID_UPDATE_BODY = {
    'roles_to_attach': [],
    'roles_to_detach': [application.INSIGHTS_BASE_ROLE],
    'tenant': {
        'tenant_type': constants.PARENT_COMPANY_TENANT_TYPE,
        'tenant_uuid': parent_companies.ORCHARD_PARENT_COMPANY_UUID,
    },
}


def test_update_employee_without_jwt() -> None:
    """Test updating an internal user without a JWT."""
    headers = {
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.OWS_PERMISSIONS_VENDOR_STAR_USER_ID,
        'Orchard-Profile-Id': utils.OWS_PERMISSIONS_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    res = requests.patch(
        f'{config.QA_BASE_URL}/internal/v2/identities/{utils.TEST_EMPLOYEE_USER_ID}',
        json=VALID_UPDATE_BODY,
        headers=headers,
    )

    assert res.status_code == 401
    assert res.json().get('code') == 'authorization_error'
    assert res.json().get('message') == 'Request context has no identity uuid.'


def test_update_employee_without_pp_role(
    bearer_token_user_with_vendor_star: str,
) -> None:
    """Test updating an employee without having the proper role."""
    headers = {
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Content-Type': 'application/json',
    }

    res = requests.patch(
        f'{config.QA_BASE_URL}/internal/v2/identities/{utils.TEST_EMPLOYEE_USER_ID}',
        json=VALID_UPDATE_BODY,
        headers=headers,
    )

    assert res.status_code == 403


@pytest.mark.parametrize(
    'request_body',
    [
        pytest.param(
            {
                **VALID_UPDATE_BODY,
                'tenant': {
                    'tenant_type': 'subaccount',
                    'tenant_uuid': parent_companies.ORCHARD_PARENT_COMPANY_UUID,
                },
            },
            id='Invalid tenant type',
        ),
        pytest.param(
            {
                **VALID_UPDATE_BODY,
                'tenant': {
                    'tenant_type': constants.PARENT_COMPANY_TENANT_TYPE,
                    'tenant_uuid': 'invalid-uuid',
                },
            },
            id='Invalid tenant uuid',
        ),
        pytest.param(
            {**VALID_UPDATE_BODY, 'roles_to_attach': [], 'roles_to_detach': []},
            id='Empty roles to attach and detach',
        ),
        pytest.param(
            {
                **VALID_UPDATE_BODY,
                'roles_to_attach': [application.SETTINGS_BASE_ROLE],
                'roles_to_detach': [application.SETTINGS_BASE_ROLE],
            },
            id='Same role in attach and detach',
        ),
        pytest.param(
            {**VALID_UPDATE_BODY, 'roles_to_attach': ['invalid-role']},
            id='Invalid role in roles to attach',
        ),
        pytest.param(
            {**VALID_UPDATE_BODY, 'roles_to_detach': ['invalid-role']},
            id='Invalid role in roles to detach',
        ),
    ],
)
def test_update_employee_validation(seat_admin_jwt: str, request_body: dict) -> None:
    """Test updating an employee with various invalid request bodies."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
    }

    res = requests.patch(
        f'{config.QA_BASE_URL}/internal/v2/identities/{utils.TEST_EMPLOYEE_USER_ID}',
        json=request_body,
        headers=headers,
    )

    assert res.status_code == 400


def test_update_employee_attach(seat_admin_jwt: str, new_employee_id: str) -> None:
    """Test updating an employee by attaching a role."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.OWS_PERMISSIONS_SEAT_ADMIN_USER_ID,
        'Orchard-Profile-Id': utils.OWS_PERMISSIONS_SEAT_ADMIN_USER_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    # User already has orchard access, now attaching sme access
    body = {
        'roles_to_attach': [application.SETTINGS_BASE_ROLE],
        'roles_to_detach': [],
        'tenant': {
            'tenant_type': constants.PARENT_COMPANY_TENANT_TYPE,
            'tenant_uuid': parent_companies.SME_PARENT_COMPANY_UUID,
        },
    }

    res = requests.patch(
        f'{config.QA_BASE_URL}/internal/v2/identities/{new_employee_id}',
        json=body,
        headers=headers,
    )

    assert res.status_code == 200
    # TODO: Verify access change once employee tenant info can be fetched via API


def test_update_employee_detach(seat_admin_jwt: str, new_employee_id: str) -> None:
    """Test updating an employee by detaching a role."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.OWS_PERMISSIONS_SEAT_ADMIN_USER_ID,
        'Orchard-Profile-Id': utils.OWS_PERMISSIONS_SEAT_ADMIN_USER_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    # User has two roles for orchard access, now detaching one of them
    body = {
        'roles_to_attach': [],
        'roles_to_detach': [application.SETTINGS_BASE_ROLE],
        'tenant': {
            'tenant_type': constants.PARENT_COMPANY_TENANT_TYPE,
            'tenant_uuid': parent_companies.ORCHARD_PARENT_COMPANY_UUID,
        },
    }

    res = requests.patch(
        f'{config.QA_BASE_URL}/internal/v2/identities/{new_employee_id}',
        json=body,
        headers=headers,
    )

    assert res.status_code == 200
    # TODO: Verify access change once employee tenant info can be fetched via API


@pytest.mark.parametrize(
    ('role', 'tenant_uuid', 'expected_status'),
    [
        # Test Label (id 7123) - has fansifter and songwhip
        (application.SONGWHIP_READ_ROLE, '573d0372-7f2f-48a6-8deb-c9a6558f9549', 200),
        (application.FANSIFTER_BASE_ROLE, '573d0372-7f2f-48a6-8deb-c9a6558f9549', 200),
        (application.BANKING_TAX_BASE_ROLE, '573d0372-7f2f-48a6-8deb-c9a6558f9549', 400),
        # TEST (id 9233) - no fansifter or songwhip
        (application.SONGWHIP_READ_ROLE, '7c3fa386-70ab-4f72-9dcc-04794e3c573d', 422),
        (application.FANSIFTER_BASE_ROLE, '7c3fa386-70ab-4f72-9dcc-04794e3c573d', 422),
    ],
)
def test_update_employee_with_account_tenant_type(
    seat_admin_jwt: str, new_employee_id: str, role: str, tenant_uuid: str, expected_status: int
) -> None:
    """Test adding songwhip and fansifter roles to an employee."""
    headers = {
        'Authorization': f'Bearer {seat_admin_jwt}',
        'Content-Type': 'application/json',
        'Orchard-Identity-Id': utils.OWS_PERMISSIONS_SEAT_ADMIN_USER_ID,
        'Orchard-Profile-Id': utils.OWS_PERMISSIONS_SEAT_ADMIN_USER_SETTINGS_PROFILE_ID,
        'Orchard-Profile-Type': 'SettingsProfile',
    }
    body = {
        'roles_to_attach': [role],
        'roles_to_detach': [],
        'tenant': {
            'tenant_type': constants.ACCOUNT_TENANT_TYPE,
            'tenant_uuid': tenant_uuid,
        },
    }

    res = requests.patch(
        f'{config.QA_BASE_URL}/internal/v2/identities/{new_employee_id}', json=body, headers=headers
    )

    assert res.status_code == expected_status, res.text