"""Test the DELETE /v2/identities/<identity_id> endpoint."""

import requests

from tests.integration import config, utils


def test_revoke_all_access_deactivate_user(
    bearer_token_user_with_vendor_star: str, create_identity_json: dict
):
    """Test DELETE /v2/identities/<identity_id> deactivates the user when no tenants remain."""
    headers = {
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Orchard-Profile-Type': 'SettingsProfile',
        'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
    }
    # Create a new user first
    res = requests.post(
        f'{config.QA_BASE_URL}/v2/identities',
        json=create_identity_json,
        headers=headers,
    )
    identity_id = res.json()['id']

    # Now delete it 😈
    res = requests.delete(f'{config.QA_BASE_URL}/v2/identities/{identity_id}', headers=headers)
    assert res.status_code == 204

    # Get the vendors this user and the caller both have access to; see that there are none
    res = requests.get(
        f'{config.QA_BASE_URL}/identity/{identity_id}/direct-access/resources/Vendor',
        headers=headers,
    )
    assert len(res.json()['items']) == 0

    # Get the identity and see that active is set to N
    res = requests.get(f'{config.QA_OWS_USERS_URL}/users/identity/{identity_id}', headers=headers)
    assert res.json()['active'] == 'N'


def test_revoke_all_access_dont_deactivate(
    bearer_token_user_with_vendor_star: str,
    bearer_token_user_without_vendor_star: str,
    create_identity_json: dict,
):
    """Test DELETE /v2/identities/<identity_id> doesn't deactivate the user when tenants remain."""
    vendor_star_headers = {
        'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
        'Orchard-Profile-Type': 'SettingsProfile',
        'Orchard-Profile-Id': utils.OWS_ACCOUNT_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
    }
    res = requests.post(
        f'{config.QA_BASE_URL}/v2/identities',
        json=create_identity_json,
        headers=vendor_star_headers,
    )
    identity_id = res.json()['id']

    # Add Platform Test Vendor to this user with a caller that doesn't have vendor * access
    headers = {
        'Authorization': f'Bearer {bearer_token_user_without_vendor_star}',
        'Orchard-Profile-Type': 'SettingsProfile',
        'Orchard-Profile-Id': utils.OWS_PERMISSIONS_TEST_USER_SETTINGS_PROFILE_ID,
        'Orchard-Identity-Id': utils.OWS_PERMISSIONS_TEST_USER_ID,
    }
    requests.patch(
        f'{config.QA_BASE_URL}/v2/identities/{identity_id}',
        json={
            'roles_to_attach': ['INSIGHTS_BASE_ROLE'],
            'roles_to_detach': [],
            'tenant': {
                'tenant_type': 'account',
                'tenant_uuid': '2e79b9b8-29ed-44e1-832f-2aa3b47f13c8',
            },
        },
        headers=headers,
    )

    # Now "delete" this user, but with the caller that only has access to the tenant it just added
    res = requests.delete(f'{config.QA_BASE_URL}/v2/identities/{identity_id}', headers=headers)
    assert res.status_code == 204

    # Get the vendors this user and the caller both have access to; see that there are none
    res = requests.get(
        f'{config.QA_BASE_URL}/identity/{identity_id}/direct-access/resources/Vendor',
        headers=headers,
    )
    assert len(res.json()['items']) == 0

    # Get the identity and see that active is still set to Y
    res = requests.get(
        f'{config.QA_OWS_USERS_URL}/users/identity/{identity_id}', headers=vendor_star_headers
    )
    assert res.json()['active'] == 'Y'