"""Test token model."""

from unittest.mock import MagicMock

from botocore.exceptions import ClientError

from moto import mock_sts

from pricing import config
from pricing.connectors import sentry
from pricing.connectors import sts
from pricing.models import token

import pytest


@pytest.fixture
def fixture_set_iam_role():
    """Fixture to set IAM role."""
    config.IAM_ROLE = 'arn:aws:iam::11111111111:role/ows-pricing-service-role'


@pytest.fixture
def fixture_filename():
    """Fixture to generate a filename."""
    return 'a_filename'


@pytest.fixture
def fixture_assume_role_error():
    """Fixture for an STS ClientError."""
    sts_error = {
        'Error': {
            'Code': 'AccessDeniedException',
            'Message': 'Error assuming role'
        },
        'ResponseMetadata': {
            'HTTPStatusCode': 403
        }
    }
    return MagicMock(side_effect=ClientError(
        error_response=sts_error, operation_name='AssumeRole'))


@pytest.fixture
def fixture_token_dict():
    """Fixture for a token."""
    return {
        'token': 'a token',
        'aws_access_key_id': 'access key',
        'aws_secret_access_key': 'secret key',
        'expiration': 'today'
    }


def fixture_policy_helper(bucket):
    """Fixture for iam policy for s3.

    Args:
        bucket (string): name of bucket.
    Returns:
        dict: Expected structure of iam policy for s3.
    """
    return {
        'Version': '2012-10-17',
        'Statement': [
            {
                'Effect': 'Allow',
                'Action': [
                    's3:PutObject'
                ],
                'Resource': 'arn:aws:s3:::{bucket}/*'.format(
                    bucket=bucket)
            }
        ]
    }


@pytest.fixture
def fixture_policy(bucket):
    """Fixture policy."""
    return fixture_policy_helper(bucket)


def test__to_dict():
    """Test converting an aws credential object."""
    session_token = 'a session token'
    access_key = 'access'
    secret_key = 'shhhhh'
    expiration = 'in 900 seconds'
    sts_response = {
        'Credentials': {
            'SessionToken': session_token,
            'AccessKeyId': access_key,
            'SecretAccessKey': secret_key,
            'Expiration': expiration
        }
    }

    result = token._to_dict(sts_response)
    assert result.get('token') == session_token
    assert result.get('aws_access_key_id') == access_key
    assert result.get('aws_secret_access_key') == secret_key
    assert result.get('expiration') == expiration


def test__prepare_iam_policy_s3(monkeypatch):
    """Test iam policy for s3 uses bucket name and filename."""
    expected = {
        'Version': '2012-10-17',
        'Statement': [
            {
                'Effect': 'Allow',
                'Action': [
                    's3:PutObject'
                ],
                'Resource': 'arn:aws:s3:::bucket/*'
            }
        ]
    }

    result = token._prepare_iam_policy_s3('bucket')
    assert result == expected


def test_get_s3_token_fails_no_sts(monkeypatch, fixture_filename):
    """Test get_s3_token fails when no sts connection."""
    monkeypatch.setattr(sts, 'get_sts_client', MagicMock(return_value=None))
    result = token.get_s3_token(fixture_filename)
    assert result.status == 500


@mock_sts
def test_get_s3_token_failure(monkeypatch, fixture_set_iam_role,
                              fixture_filename,
                              fixture_assume_role_error):
    """Test get_s3_token fails when server error."""
    sts_client = sts.get_sts_client()
    monkeypatch.setattr(sts_client, 'assume_role', fixture_assume_role_error)

    result = token.get_s3_token(fixture_filename)
    assert not result


@mock_sts
def test_get_s3_token(monkeypatch, fixture_token_dict, fixture_set_iam_role,
                      fixture_filename):
    """Test get_s3_token succeeds."""
    policy = fixture_policy_helper('a_bucket')
    monkeypatch.setattr(
        token, '_prepare_iam_policy_s3', MagicMock(return_value=policy))

    token_to_dict = MagicMock(return_value=fixture_token_dict)
    monkeypatch.setattr(
        token, '_to_dict', token_to_dict)

    result = token.get_s3_token(fixture_filename)
    assert result
    assert result.message == fixture_token_dict

    sts_response = token_to_dict.call_args[0][0]
    assert sts_response['Credentials']
    credentials = sts_response['Credentials']
    assert credentials['SessionToken']
    assert credentials['AccessKeyId']
    assert credentials['SecretAccessKey']
    assert credentials['Expiration']