"""Test the POST /v2/identities/tenants/dataloader endpoint."""

import requests

from permissions.constants.constants import VENDOR_STAR_UUID
from tests.integration import config, utils


def test_unauthenticated():
    """Integration test for no jwt."""
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        json={'identity_uuids': [utils.NO_SETTINGS_USER_ID]},
    )

    assert response.status_code == 401


def test_unauthorized(bearer_token_user_without_settings):
    """Integration test for no settings profile."""
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token_user_without_settings}'},
        json={'identity_uuids': [utils.NO_SETTINGS_USER_ID]},
    )

    assert response.status_code == 403


def test_employee_admin_sees_all_tenants_for_multiple_identities(
    bearer_token_user_with_vendor_star,
):
    """Integration test for an admin with vendor * getting multiple users' tenants."""
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token_user_with_vendor_star}'},
        json={
            'identity_uuids': [
                utils.NO_SETTINGS_USER_ID,
                utils.TEST_EMPLOYEE_USER_ID,
            ]
        },
    )

    assert response.status_code == 200

    identities = response.json()['identities']
    assert len(identities) == 2

    # First identity - NO_SETTINGS_USER_ID
    first_identity = identities[0]
    assert first_identity is not None
    assert first_identity['identity_uuid'] == utils.NO_SETTINGS_USER_ID
    tenants = first_identity['tenants']

    # "Test Label" vendor
    vendor1 = next(t for t in tenants if t['tenant_uuid'] == '573d0372-7f2f-48a6-8deb-c9a6558f9549')
    assert vendor1['tenant_type'] == 'account'
    assert vendor1['roles'] == ['COLLABORATORS_BASE_ROLE']

    # Frenchkiss
    vendor2 = next(t for t in tenants if t['tenant_uuid'] == 'fff741c2-6def-4493-bfdf-c2bcb1128e02')
    assert vendor2['tenant_type'] == 'account'
    assert sorted(vendor2['roles']) == [
        'COLLABORATORS_BASE_ROLE',
        'INSIGHTS_BASE_ROLE',
        'WORKSTATION_ADVERTISING_ROLE',
        'WORKSTATION_ANALYTICS_BASE_ROLE',
        'WORKSTATION_CATALOG_ROLE',
        'WORKSTATION_MARKETING_ROLE',
    ]

    # Second identity - TEST_EMPLOYEE_USER_ID
    second_identity = identities[1]
    assert second_identity is not None
    assert second_identity['identity_uuid'] == utils.TEST_EMPLOYEE_USER_ID
    second_tenants = second_identity['tenants']
    # Verify vendor star is not in the tenants
    tenant_uuids = [t['tenant_uuid'] for t in second_tenants]
    assert VENDOR_STAR_UUID not in tenant_uuids


def test_non_employee_admin_sees_some_tenants_for_multiple_identities(bearer_token):
    """Integration test for an admin without vendor * getting multiple users' tenants."""
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token}'},
        json={
            'identity_uuids': [
                utils.NO_SETTINGS_USER_ID,
                utils.TEST_EMPLOYEE_USER_ID,
            ]
        },
    )

    assert response.status_code == 200

    identities = response.json()['identities']
    assert len(identities) == 2

    # First identity - NO_SETTINGS_USER_ID (has tenants in common)
    first_identity = identities[0]
    assert first_identity is not None
    assert first_identity['identity_uuid'] == utils.NO_SETTINGS_USER_ID
    assert first_identity['tenants'] == [
        # These two users only have the "Test Label" vendor in common
        {
            'tenant_uuid': '573d0372-7f2f-48a6-8deb-c9a6558f9549',
            'tenant_type': 'account',
            'roles': ['COLLABORATORS_BASE_ROLE'],
        }
    ]

    # Second identity - TEST_EMPLOYEE_USER_ID (no common tenants, should be None or empty)
    # The admin doesn't have access to this employee's tenants
    second_identity = identities[1]
    # Based on the dataloader pattern, this should be None for identities the admin can't see
    assert second_identity is None or second_identity.get('tenants') == []


def test_admin_sees_audience_profile_roles_for_multiple_identities(
    bearer_token_user_with_vendor_star,
):
    """Integration test for an admin getting multiple users' fansifter roles."""
    # User fansifter_test_1@sonymusic-pde.com
    identity_id = 'ad8135ca-e000-4e59-8a12-c6b56fb0dad7'

    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token_user_with_vendor_star}'},
        json={'identity_uuids': [identity_id, utils.NO_SETTINGS_USER_ID]},
    )

    assert response.status_code == 200

    identities = response.json()['identities']
    assert len(identities) == 2

    # First identity - the fansifter user
    first_identity = identities[0]
    assert first_identity is not None
    assert first_identity['identity_uuid'] == identity_id
    assert next(
        tenant
        for tenant in first_identity['tenants']
        if tenant['tenant_type'] == 'account' and 'fansifter_can_view_fan_data' in tenant['roles']
    )


def test_dataloader_maintains_order_with_missing_identity(bearer_token_user_with_vendor_star):
    """Integration test to verify dataloader maintains order and returns None for missing identities."""
    fake_uuid = '00000000-0000-0000-0000-000000000000'

    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token_user_with_vendor_star}'},
        json={
            'identity_uuids': [
                utils.NO_SETTINGS_USER_ID,
                fake_uuid,  # Non-existent identity
                utils.TEST_EMPLOYEE_USER_ID,
            ]
        },
    )

    assert response.status_code == 200

    identities = response.json()['identities']
    assert len(identities) == 3

    # First identity should have data
    assert identities[0] is not None
    assert identities[0]['identity_uuid'] == utils.NO_SETTINGS_USER_ID

    # Second identity (fake UUID) should be None
    assert identities[1] is None

    # Third identity should have data
    assert identities[2] is not None
    assert identities[2]['identity_uuid'] == utils.TEST_EMPLOYEE_USER_ID


def test_empty_identity_uuids_list(bearer_token_user_with_vendor_star):
    """Integration test for empty identity_uuids list."""
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token_user_with_vendor_star}'},
        json={'identity_uuids': []},
    )

    assert response.status_code == 200
    identities = response.json()['identities']
    assert identities == []


def test_seat_admin_sees_all_identity_tenants(seat_admin_jwt):
    """Integration test for SEAT path: all identities return tenants (no employee filtering)."""
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {seat_admin_jwt}'},
        json={
            'identity_uuids': [
                utils.TEST_EMPLOYEE_USER_ID,
                utils.NO_SETTINGS_USER_ID,
            ]
        },
    )

    assert response.status_code == 200

    identities = response.json()['identities']
    assert len(identities) == 2

    # First identity - TEST_EMPLOYEE_USER_ID should have tenants
    first_identity = identities[0]
    assert first_identity is not None
    assert first_identity['identity_uuid'] == utils.TEST_EMPLOYEE_USER_ID
    assert isinstance(first_identity['tenants'], list)

    # Second identity - NO_SETTINGS_USER_ID should also have tenants (no employee filtering)
    second_identity = identities[1]
    assert second_identity is not None
    assert second_identity['identity_uuid'] == utils.NO_SETTINGS_USER_ID
    assert isinstance(second_identity['tenants'], list)


def test_invalid_uuid_format(bearer_token_user_with_vendor_star):
    """Integration test for invalid UUID format."""
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token_user_with_vendor_star}'},
        json={'identity_uuids': ['not-a-valid-uuid']},
    )

    # Should return 400 due to validation error
    assert response.status_code == 400


def test_missing_identity_uuids_field(bearer_token_user_with_vendor_star):
    """Integration test for missing identity_uuids field."""
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token_user_with_vendor_star}'},
        json={},
    )

    # Should return 400 due to validation error
    assert response.status_code == 400


def test_settings_admin_sees_no_tenants_for_new_employee(
    bearer_token_user_with_vendor_star, new_employee_id
):
    """Settings admin should see empty tenants for a new employee.

    Employees have a parent_company tenant (and vendor star), neither of which
    are returned by the non-internal dataloader endpoint.
    """
    response = requests.post(
        f'{config.QA_BASE_URL}/v2/identities/tenants/dataloader',
        headers={'Authorization': f'Bearer {bearer_token_user_with_vendor_star}'},
        json={'identity_uuids': [new_employee_id]},
    )

    assert response.status_code == 200
    identities = response.json()['identities']
    assert len(identities) == 1

    identity = identities[0]
    assert identity['identity_uuid'] == new_employee_id
    assert identity['tenants'] == []