"""Test the DELETE /v2/identities/<identity_id>/tenants/<tenant_type>/<tenant_uuid> endpoint."""

import requests

from tests.integration import config, utils


def test_revoke_access_to_single_tenant(
    bearer_token_user_with_vendor_star: str, create_identity_json: dict
):
    """Test v2_revoke_access_to_single_tenant_for_identity."""
    headers = {
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Orchard-Profile-Type': 'SettingsProfile',
        'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
    }
    tenant_type = 'label_participant'
    # Label participant under Columbia
    original_tenant_uuid = 'a7adfa7e-1192-4d24-a20d-28d3e8cd7f6d'
    create_body = {
        **create_identity_json,
        'roles_to_attach': ['INSIGHTS_BASE_ROLE'],
        'tenant': {
            'tenant_type': tenant_type,
            # Label participant under Columbia
            'tenant_uuid': original_tenant_uuid,
        },
    }
    # Create a new user first
    res = requests.post(
        f'{config.QA_BASE_URL}/v2/identities',
        json=create_body,
        headers=headers,
    )
    identity_id = res.json()['id']
    # Label participant under Columbia
    tenant_uuid = 'c5b9bae9-9ee4-4993-97fe-b758dd0c9cbc'

    # Update the user by adding access to another single tenant
    res = requests.patch(
        f'{config.QA_BASE_URL}/v2/identities/{identity_id}',
        json={
            'roles_to_attach': ['INSIGHTS_BASE_ROLE'],
            'roles_to_detach': [],
            'tenant': {
                'tenant_type': tenant_type,
                'tenant_uuid': tenant_uuid,
            },
        },
        headers=headers,
    )

    # Now revoke access to a single tenant
    res = requests.delete(
        f'{config.QA_BASE_URL}/v2/identities/{identity_id}/tenants/{tenant_type}/{tenant_uuid}',
        headers=headers,
    )
    assert res.status_code == 204

    # Get the vendors this user and the caller both have access to; see that there is one.
    res = requests.get(
        f'{config.QA_BASE_URL}/identity/{identity_id}/direct-access/resources/LabelParticipant',
        headers=headers,
    )
    assert len(res.json()['items']) == 1
    assert res.json()['items'][0]['uuid'] == original_tenant_uuid


def test_revoke_access_to_single_tenant_deactivate(
    bearer_token_user_with_vendor_star: str, create_identity_json_no_workstation: dict
):
    """Test v2_revoke_access_to_single_tenant_for_identity deactivates user."""
    headers = {
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Orchard-Profile-Type': 'SettingsProfile',
        'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
    }
    # Create a new user first
    res = requests.post(
        f'{config.QA_BASE_URL}/v2/identities',
        json=create_identity_json_no_workstation,
        headers=headers,
    )
    identity_id = res.json()['id']
    tenant_type = 'account'
    tenant_uuid = 'dffedd4d-b88d-444d-a9eb-6ce89aa4d2f6'

    # Now revoke access to a single tenant
    # This is the last tenant, so the user should be deactivated
    res = requests.delete(
        f'{config.QA_BASE_URL}/v2/identities/{identity_id}/tenants/{tenant_type}/{tenant_uuid}',
        headers=headers,
    )
    assert res.status_code == 204

    # Get the identity and see that active is set to N
    res = requests.get(f'{config.QA_OWS_USERS_URL}/users/identity/{identity_id}', headers=headers)
    assert res.json()['active'] == 'N'


def test_revoke_access_to_single_tenant_tenant_not_found(
    bearer_token_user_vendor_star_not_superadmin: str, create_identity_json: dict
):
    """Test revoke access returns 404 when tenant doesn't exist."""
    headers = {
        'Authorization': f'Bearer {bearer_token_user_vendor_star_not_superadmin}',
        'Orchard-Profile-Type': 'SettingsProfile',
        'Orchard-Profile-Id': utils.OWS_PERMISSIONS_VENDOR_STAR_USER_SETTINGS_PROFILE_ID,
        'Orchard-Identity-Id': utils.OWS_PERMISSIONS_VENDOR_STAR_USER_ID,
    }

    # Create a new user first
    res = requests.post(
        f'{config.QA_BASE_URL}/v2/identities',
        json=create_identity_json,
        headers=headers,
    )
    assert res.status_code == 200
    identity_id = res.json()['id']

    # Try to revoke access to a non-existent tenant
    res = requests.delete(
        f'{config.QA_BASE_URL}/v2/identities/{identity_id}/tenants/account/00000000-0000-0000-0000-000000000000',
        headers=headers,
    )

    assert res.status_code == 404
    assert res.json()['message'] == 'Tenant not found.'