"""Unit tests for product_staging.logic.profile.check_profile_access."""

from uuid import UUID

import pytest
from unittest.mock import MagicMock
from pytest_mock import MockerFixture

from product_staging.connectors import ows_permissions
from product_staging.logic import profile


def _make_resources_response(status: int, items: list) -> MagicMock:
    mock_resp = MagicMock()
    mock_resp.status = status
    mock_resp.message = {"items": items}
    return mock_resp


def test_check_profile_access_with_all_access(
    mocker: MockerFixture,
    identity_uuid: str,
    profiles_from_scope_fixture: list[tuple[str, int]],
) -> None:
    """Test that check_profile_access returns 200 when profile has all access."""
    profile_type, profile_id = profiles_from_scope_fixture[0]
    mock_has_all_access = mocker.patch.object(
        ows_permissions, "has_all_access", return_value=True
    )

    result = profile.check_profile_access(
        identity_id=UUID(identity_uuid),
        profile_id=profile_id,
        profile_type=profile_type,
        vendor_id=123,
    )

    assert result.status == 200
    mock_has_all_access.assert_called_once_with(
        identity_id=UUID(identity_uuid),
        profile_id=profile_id,
        profile_type=profile_type,
    )


@pytest.mark.parametrize(
    "resources, vendor_id, subaccount_id, expected_status",
    [
        # Direct vendor access
        ([{"id": 123, "type": profile.RESOURCE_TYPE_VENDOR}], 123, None, 200),
        # Wildcard vendor access
        (
            [{"id": profile.ALL_VENDORS_ID, "type": profile.RESOURCE_TYPE_VENDOR}],
            999,
            None,
            200,
        ),
        # Subaccount access
        ([{"id": 555, "type": profile.RESOURCE_TYPE_SUBACCOUNT}], 123, 555, 200),
        # No matching access
        ([{"id": 888, "type": profile.RESOURCE_TYPE_VENDOR}], 123, 555, 403),
    ],
)
def test_check_profile_access_resource_check(
    mocker: MockerFixture,
    identity_uuid: str,
    profiles_from_scope_fixture: list[tuple[str, int]],
    resources: list,
    vendor_id: int,
    subaccount_id: int | None,
    expected_status: int,
) -> None:
    profile_type, profile_id = profiles_from_scope_fixture[0]
    mocker.patch.object(ows_permissions, "has_all_access", return_value=False)
    mock_get_profile_resources = mocker.patch.object(
        ows_permissions,
        "get_profile_resources",
        return_value=_make_resources_response(200, resources),
    )

    result = profile.check_profile_access(
        identity_id=UUID(identity_uuid),
        profile_id=profile_id,
        profile_type=profile_type,
        vendor_id=vendor_id,
        subaccount_id=subaccount_id,
    )

    assert result.status == expected_status
    mock_get_profile_resources.assert_called_once_with(
        profile_id, profile_type, resource_type="label"
    )


def test_no_resources_response(
    mocker: MockerFixture,
    identity_uuid: str,
    profiles_from_scope_fixture: list[tuple[str, int]],
) -> None:
    profile_type, profile_id = profiles_from_scope_fixture[0]
    # get_profile_resources returns None or falsy
    mocker.patch.object(ows_permissions, "has_all_access", return_value=False)
    mocker.patch.object(ows_permissions, "get_profile_resources", return_value=None)

    result = profile.check_profile_access(
        identity_id=UUID(identity_uuid),
        profile_id=profile_id,
        profile_type=profile_type,
        vendor_id=123,
    )

    assert result is None