"""Test POST /identity/{identity_id}/edit-resources-profiles."""

import uuid
from typing import Any

import pytest
import requests

from permissions.constants import constants
from tests.integration import config, utils


def test_edit_identity_profiles_access_to_resources(bearer_token_user_with_vendor_star):
    """Test edit identity, profiles and access to resources."""
    # create an identity with resources
    identity = utils.create_identity_data()
    resource_access = [utils.LABEL_PARTICIPANT_TEST_RESOURCE]
    new_resource_access = [utils.SUBACCOUNT_EDIT_TEST_RESOURCE]
    subaccount_resource_id = 77082
    data = {'identity': identity, 'resource_access': resource_access, 'create_auth0_user': False}
    headers = {
        'Content-Type': 'application/json',
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Orchard-Profile-Type': constants.SETTINGSPROFILE,
        'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
    }

    res = requests.post(
        f'{config.QA_BASE_URL}/identity/add-resources-profiles', json=data, headers=headers
    )
    assert res.status_code == 200, res.text
    identity_id = res.json()['identities_affected'][0]['id']
    insights_profile_id = res.json()['profiles_affected'][0]['profile_id']
    data = {'resource_access': new_resource_access}

    # edit resource access for identity
    res = requests.post(
        f'{config.QA_BASE_URL}/identity/{identity_id}/edit-resources-profiles',
        json=data,
        headers=headers,
    )
    assert res.status_code == 200, res.text
    assert res.json()['id'] == identity_id

    # check that we have access to Subaccount after editing and don't have it to LabelParticipant
    res = requests.get(
        f'{config.QA_BASE_URL}/admin/profile-type/{constants.INSIGHTSPROFILE}'
        f'/profile/{insights_profile_id}/resource/all',
        headers=headers,
    )
    assert next(
        item
        for item in res.json()['items']
        if item.get('id') == subaccount_resource_id
        and item['type'] == constants.SUBACCOUNT_RESOURCE_TYPE
    )


@pytest.mark.parametrize(
    'identity, expected_status_code, expected_error',
    [
        pytest.param(
            utils.create_identity_data(),
            403,
            {'code': 'bad_request', 'message': 'Cannot assign resource to this identity'},
            id='Identity does not qualify to receive vendor* access',
        ),
        pytest.param(
            utils.create_allowed_identity_for_vendor_star(),
            200,
            None,
            id='Identity is allowed to receive vendor* access',
        ),
    ],
)
def test_edit_identity_profiles_access_to_vendor_star(
    bearer_token_user_with_vendor_star: str,
    identity: dict[str, Any],
    expected_status_code: int,
    expected_error: dict[str, Any] | None,
) -> None:
    """Test edit identity, profiles and access to vendor *."""
    resource_access = [utils.LABEL_PARTICIPANT_TEST_RESOURCE]
    new_resource_access = [utils.VENDOR_CREATE_TEST_RESOURCE]
    new_resource_id = '*'
    data = {'identity': identity, 'resource_access': resource_access, 'create_auth0_user': False}
    headers = {
        'Content-Type': 'application/json',
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Orchard-Profile-Type': constants.SETTINGSPROFILE,
        'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
    }

    res = requests.post(
        f'{config.QA_BASE_URL}/identity/add-resources-profiles', json=data, headers=headers
    )
    assert res.status_code == 200, res.text
    identity_id = res.json()['identities_affected'][0]['id']
    insights_profile_id = res.json()['profiles_affected'][0]['profile_id']
    data = {'resource_access': new_resource_access}

    # edit resource access for identity
    res = requests.post(
        f'{config.QA_BASE_URL}/identity/{identity_id}/edit-resources-profiles',
        json=data,
        headers=headers,
    )
    assert res.status_code == expected_status_code, res.text
    if expected_status_code == 200:
        assert res.json()['id'] == identity_id, res.text
    else:
        assert res.json() == expected_error, res.text

    # Fetch the current state of resource access on the profile
    res = requests.get(
        f'{config.QA_BASE_URL}/admin/profile-type/{constants.INSIGHTSPROFILE}'
        f'/profile/{insights_profile_id}/resource/all',
        headers=headers,
    )
    if expected_status_code == 200:
        # If we expected to successfully edit/assign Vendor*,
        # check that it is here
        vendor_star_is_present = False
        for item in res.json()['items']:
            if item.get('id') == new_resource_id:
                vendor_star_is_present = True
        assert vendor_star_is_present, res.json()
    else:
        # If we expect that we did not successfully edit/assign Vendor*,
        # check that it is not here
        for item in res.json()['items']:
            assert item.get('id') != new_resource_id


@pytest.mark.parametrize(
    'identity_id',
    [
        ('edit-test'),
        (str(uuid.uuid4())),
        ('584f6449-06e1-4007-bde6-da64e26c807a'),
    ],
)
def test_edit_access_to_non_existent_identity(
    bearer_token_user_with_vendor_star: str, identity_id: str
) -> None:
    """Test fails to edit access when identity does not exist."""
    data = {
        'resource_access': [
            utils.LABEL_PARTICIPANT_TEST_RESOURCE,
            utils.SUBACCOUNT_EDIT_TEST_RESOURCE,
        ]
    }

    res = requests.post(
        f'{config.QA_BASE_URL}/identity/{identity_id}/edit-resources-profiles',
        json=data,
        headers={
            'Content-Type': 'application/json',
            'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
            'Orchard-Profile-Type': constants.SETTINGSPROFILE,
            'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
            'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
        },
    )
    assert res.status_code == 404
    assert res.json()['message'] == 'Identity not found with this id.'