"""Test POST /identity/add-resources-profiles."""

from __future__ import annotations

from typing import Any

import pytest
import requests

from permissions.constants import constants
from tests.integration import config, utils


@pytest.mark.parametrize(
    (
        'resource_access',
        'identity',
        'expected_status_code',
        'expected_error',
    ),
    [
        pytest.param(
            [utils.LABEL_PARTICIPANT_TEST_RESOURCE],
            utils.create_identity_data(),
            200,
            None,
            id='Test creates identity, profiles and access to resources.',
        ),
        pytest.param(
            [utils.VENDOR_CREATE_TEST_RESOURCE, utils.LABEL_PARTICIPANT_TEST_RESOURCE],
            utils.create_identity_data(),
            403,
            {'code': 'bad_request', 'message': 'Cannot assign resource to this identity'},
            id='Regular identity is not allowed to receive the vendor* resource',
        ),
        pytest.param(
            [utils.VENDOR_CREATE_TEST_RESOURCE],
            utils.create_allowed_identity_for_vendor_star(),
            200,
            None,
            id='Test creates identity, profiles and super admin access to resources',
        ),
    ],
)
def test_create_identity_profiles_access_to_resources(
    bearer_token_user_with_vendor_star: str,
    resource_access: list[dict[str, Any]],
    identity: dict[str, Any],
    expected_status_code: int,
    expected_error: dict[str, Any] | None,
) -> None:
    """Test creates identity, profiles and access to resources."""
    data = {'identity': identity, 'resource_access': resource_access, 'create_auth0_user': False}

    res = requests.post(
        f'{config.QA_BASE_URL}/identity/add-resources-profiles',
        json=data,
        headers={
            'Content-Type': 'application/json',
            'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
            'Orchard-Profile-Type': constants.SETTINGSPROFILE,
            'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
            'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
        },
    )
    assert res.status_code == expected_status_code, res.text
    if expected_status_code == 200:
        assert res.json()['profiles_affected']
        assert res.json()['profiles_affected'][0]['profile_type'] == 'InsightsProfile'
        assert res.json()['identities_affected']
        assert res.json()['identities_affected'][0]['email'] == identity['email']
        assert res.json()['identities_affected'][0]['first_name'] == identity['first_name']
        assert res.json()['identities_affected'][0]['last_name'] == identity['last_name']
        assert res.json()['identities_affected'][0]['auth0_user_id']
        assert res.json()['identities_affected'][0]['id']
    else:
        assert res.json() == expected_error, res.text


def test_access_to_not_existing_resource(bearer_token_user_with_vendor_star):
    """Test fails to give access when resource does not exist."""
    identity = utils.create_identity_data()
    resource_access = [{'resource_type': 'Vendor', 'uuid': '', 'roles': ['analytics']}]
    data = {'identity': identity, 'resource_access': resource_access}

    res = requests.post(
        f'{config.QA_BASE_URL}/identity/add-resources-profiles',
        json=data,
        headers={
            'Content-Type': 'application/json',
            'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
            'Orchard-Profile-Type': constants.SETTINGSPROFILE,
            'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
            'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
        },
    )
    assert res.status_code == 404
    assert (
        res.json()['message'] == 'Missing resource information. Could not assign resource access.'
    )