"""Tests for GET /users/identity/email/<email>/valid-invitation endpoint.

These tests cover the path where the `auth0_use_jwt_for_invitation_check` feature flag
is enabled, so authentication is done via a JWT bearer token instead of orchadmin headers.
"""

from collections.abc import Generator
from typing import Any
import uuid

import pytest
import requests

from tests.integration import config
from tests.integration.helpers.graphql.mutations import add_user_identity
from tests.integration.helpers.matchers import StartsWith


@pytest.fixture
def new_user(
    identity_payload: dict[str, Any], grass_headers: dict[str, str], authorized_user_jwt: str
) -> Generator[dict[str, Any], None, None]:
    """Create and return a test user."""
    new_user = add_user_identity(identity_payload['email'], authorized_user_jwt)
    assert uuid.UUID(new_user['id'])

    yield new_user

    requests.delete(f"{config.QA_BASE_URL}/users/identity/{new_user['id']}", headers=grass_headers)


def test_validate_invitation_jwt_success(
    auth0_action_test_machine_jwt: str, new_user: dict[str, Any]
) -> None:
    """Test that a machine JWT returns valid=True with invitation fields for a new user."""
    res = requests.get(
        f'{config.QA_BASE_URL}/users/identity/email/{new_user["email"]}/valid-invitation',
        headers={'Authorization': f'Bearer {auth0_action_test_machine_jwt}'},
    )

    assert res.status_code == 200
    assert res.json() == {
        'valid': True,
        'invitation_id': StartsWith('uinv_'),
        'organization_id': StartsWith('org_'),
    }


def test_validate_invitation_jwt_forbidden(authorized_user_jwt: str) -> None:
    """Test that a regular user JWT is rejected by PDP with 403."""
    res = requests.get(
        f'{config.QA_BASE_URL}/users/identity/email/anyone@example.com/valid-invitation',
        headers={'Authorization': f'Bearer {authorized_user_jwt}'},
    )

    assert res.status_code == 403


def test_validate_invitation_jwt_unauthorized() -> None:
    """Test that a request without a JWT returns 401."""
    res = requests.get(
        f'{config.QA_BASE_URL}/users/identity/email/anyone@example.com/valid-invitation',
        headers={},
    )

    body = res.json()
    assert res.status_code == 401
    assert body['code'] == 'authorization_error'


def test_validate_invitation_jwt_nonexistent_user(auth0_action_test_machine_jwt: str) -> None:
    """Test that a nonexistent email returns valid=False."""
    res = requests.get(
        f'{config.QA_BASE_URL}/users/identity/email/nonexistent@example.com/valid-invitation',
        headers={'Authorization': f'Bearer {auth0_action_test_machine_jwt}'},
    )

    body = res.json()
    assert res.status_code == 200
    assert body['valid'] is False


def test_validate_invitation_jwt_expired(auth0_action_test_machine_jwt: str) -> None:
    """Test that an expired invitation returns valid=False."""
    older_invitation_email = 'iyepes-arroyo@sonymusic-pde.com'

    res = requests.get(
        f'{config.QA_BASE_URL}/users/identity/email/{older_invitation_email}/valid-invitation',
        headers={'Authorization': f'Bearer {auth0_action_test_machine_jwt}'},
    )

    body = res.json()
    assert res.status_code == 200
    assert body['valid'] is False


def test_validate_invitation_jwt_inactive_user(
    grass_headers: dict[str, str], auth0_action_test_machine_jwt: str, new_user: dict[str, Any]
) -> None:
    """Test that an inactive user's invitation returns valid=False."""
    res0 = requests.patch(
        f'{config.QA_BASE_URL}/users/identity/{new_user["id"]}',
        headers=grass_headers,
        json={'active': 'N'},
    )
    assert res0.status_code == 200

    res = requests.get(
        f'{config.QA_BASE_URL}/users/identity/email/{new_user["email"]}/valid-invitation',
        headers={'Authorization': f'Bearer {auth0_action_test_machine_jwt}'},
    )

    assert res.status_code == 200
    assert res.json()['valid'] is False