"""Unit tests for application access logic."""

from unittest import mock

import pytest

from users import constants
from users.logic import auth0_application_access


@mock.patch('users.logic.auth0_application_access.ows_pdp')
def test_check_application_access_invalid_app(mock_ows_pdp: mock.MagicMock) -> None:
    """Test that an error is raised for an invalid application name."""
    with pytest.raises(auth0_application_access.AppAccessCheckError) as exc_info:
        auth0_application_access.check_application_access('test-identity-id', 'invalid_app')

    assert exc_info.value.status_code == 422
    assert str(exc_info.value) == 'Invalid application name'
    mock_ows_pdp.get_tenant_roles_by_identity.assert_not_called()


@mock.patch('users.logic.auth0_application_access.check_seat_application_access')
@mock.patch('users.logic.auth0_application_access.ows_pdp')
def test_check_application_access_valid_app(
    mock_ows_pdp: mock.MagicMock, mock_check_seat_access: mock.MagicMock
) -> None:
    """Test that application access is checked correctly for a valid application."""
    identity_id = 'test-identity-id'
    app_name = 'seat'
    tenant_roles = {
        'uuid1': {'tenant_type': 'parent_company', 'roles': [{'role': 'seat_can_administer_users'}]}
    }
    mock_ows_pdp.get_tenant_roles_by_identity.return_value = tenant_roles
    mock_check_seat_access.return_value = True

    result = auth0_application_access.check_application_access(identity_id, app_name)

    assert result is True
    mock_ows_pdp.get_tenant_roles_by_identity.assert_called_once_with(identity_id)
    mock_check_seat_access.assert_called_once_with(tenant_roles)


@pytest.mark.parametrize(
    ['tenant_roles', 'expected_result'],
    [
        pytest.param(
            {
                constants.ORCHARD_PARENT_COMPANY_UUID: {
                    'tenant_type': 'parent_company',
                    'roles': [{'role': 'seat_can_administer_users'}],
                },
                constants.SME_PARENT_COMPANY_UUID: {
                    'tenant_type': 'parent_company',
                    'roles': [{'role': 'seat_can_administer_users'}],
                },
            },
            True,
            id='Both parent companies with seat roles',
        ),
        pytest.param(
            {
                constants.ORCHARD_PARENT_COMPANY_UUID: {
                    'tenant_type': 'parent_company',
                    'roles': [{'role': 'seat_can_administer_users'}],
                }
            },
            False,
            id='Only one parent company with seat role',
        ),
        pytest.param(
            {
                constants.ORCHARD_PARENT_COMPANY_UUID: {
                    'tenant_type': 'parent_company',
                    'roles': [{'role': 'seat_can_administer_users'}],
                },
                constants.SME_PARENT_COMPANY_UUID: {
                    'tenant_type': 'parent_company',
                    'roles': [{'role': 'other_role'}],
                },
            },
            False,
            id='Both parent companies but without seat role',
        ),
    ],
)
def test_check_seat_application_access(
    tenant_roles: dict,
    expected_result: bool,
) -> None:
    """Test the seat application access check logic."""
    result = auth0_application_access.check_seat_application_access(tenant_roles)

    assert result is expected_result