"""Integration tests for GET /meta-language.

PP check is observability-only during rollout. The legacy fallback is no
authorization, so all JWT callers (authorized or not) receive 200.

test_get_meta_language_access_rules demonstrates the access_rules.yml interaction:
when Orchard-Requestor-Service is spoofed alongside a JWT, verify_rules_access()
runs, profile_type is None (not a JWT claim), and QA enforces 403.
"""
import requests as requests_lib
import pytest

from tests.integration.client import OwsProductDigital
from tests.integration import client as client_module


BASE_URL = client_module.BASE_URL


# Subclassing OwsProductDigital to avoid merge conflicts in tests/integration/client.py
# during the Permissions Platform (PP) rollout. These methods can be merged into
# OwsProductDigital when the rollout is complete.
class _Client(OwsProductDigital):
    def get_meta_language_with_service_header(
        self,
        *,
        service_name: str = "ows-grass",
    ) -> requests_lib.Response:
        """GET /meta-language with Orchard-Requestor-Service header set.

        Forces verify_rules_access() to run the access_rules.yml check instead
        of bypassing it. JWT callers have profile_type=None, so has_access()
        returns False and QA enforces a 403.
        """
        return self._session.get(
            f"{BASE_URL}/meta-language",
            headers={"Orchard-Requestor-Service": service_name},
        )


@pytest.mark.parametrize(
    "client_fixture_name",
    [
        pytest.param(
            "client",
            id="account-level view/language user can fetch meta languages",
        ),
        pytest.param(
            "pp_client",
            id="parent-company-level view/language user can fetch meta languages",
        ),
        pytest.param(
            "no_access_client",
            id="no-access user falls through to legacy (no auth) and still gets 200",
        ),
    ],
)
def test_get_meta_language(
    client_fixture_name: str,
    request: pytest.FixtureRequest,
) -> None:
    """PP is observability-only; legacy fallback is no auth, so all callers get 200."""
    api_client = request.getfixturevalue(client_fixture_name)
    response = api_client.get_meta_language()
    assert response.status_code == 200


@pytest.mark.parametrize(
    "client_fixture_name",
    [
        pytest.param(
            "client",
            id="account-level view/language user is blocked by access_rules.yml when service header is present",
        ),
        pytest.param(
            "pp_client",
            id="parent-company-level view/language user is blocked by access_rules.yml when service header is present",
        ),
        pytest.param(
            "no_access_client",
            id="no-access user is blocked by access_rules.yml when service header is present",
        ),
    ],
)
def test_get_meta_language_access_rules(
    client_fixture_name: str,
    request: pytest.FixtureRequest,
) -> None:
    """Spoofing Orchard-Requestor-Service forces the access_rules.yml check to run.

    JWT callers have profile_type=None (not a JWT claim), which matches no profile
    in access_rules.yml. QA enforces access errors (access_log_only=False), so all
    personas receive 403.
    """
    _jwt_fixture = {"client": "jwt", "pp_client": "pp_jwt", "no_access_client": "no_access_jwt"}
    api_client = _Client(jwt=request.getfixturevalue(_jwt_fixture[client_fixture_name]))
    response = api_client.get_meta_language_with_service_header()
    assert response.status_code == 403