"""Unit tests for the can_reset_mfa function in the identities module."""

import pytest

from users.models.identities import can_reset_mfa


class NeoRecord:
    """Mock class to simulate Neo4j record behavior."""

    def __init__(self, data):
        self._data = data

    def data(self):
        return self._data


class NeoResult:
    """Mock class to simulate Neo4j result behavior."""

    def __init__(self, peek_value, single_data):
        self._peek_value = peek_value
        self._single_data = single_data

    def peek(self):
        return self._peek_value

    def single(self):
        return NeoRecord(self._single_data)


class NeoSession:
    """Mock class to simulate Neo4j session behavior."""

    def __init__(self, results):
        self.results = results
        self.index = 0

    def run(self, *args, **kwargs):
        # Accept any positional or keyword arguments
        result = self.results[self.index]
        self.index += 1
        return result


# Parametrized tests for various scenarios:
# 1. Self-reset: the admin and user are the same.
# 2. Employee query returns a valid identity (so admin has vendor '*' access).
# 3. Employee query returns a result with no identity,
#    but the overlapping tenant query finds a tenant (tenant_count > 0).
# 4. Employee query returns a result with no identity and
#    overlapping tenant query finds tenant_count = 0.
# 5. Employee query returns no result (peek() False)
#    and tenant overlap returns tenant_count > 0.
# 6. Employee query returns no result (peek() False)
#    and tenant overlap returns tenant_count = 0.
@pytest.mark.parametrize(
    ('admin_identity_id', 'identity', 'neo_results', 'expected'),
    [
        # Case 1: Self reset (no session queries executed)
        ('user1', {'id': 'user1'}, None, True),
        # Case 2: Not self-reset, first query returns a
        # result with a non-null identity
        (
            'admin1',
            {'id': 'user2'},
            [NeoResult(peek_value=True, single_data={'identity': {'id': 'admin1'}})],
            True,
        ),
        # Case 3: First query returns peek True but no identity;
        # second query returns tenant_count = 1
        (
            'admin1',
            {'id': 'user2'},
            [
                NeoResult(peek_value=True, single_data={'identity': None}),
                NeoResult(peek_value=True, single_data={'tenant_count': 1}),
            ],
            True,
        ),
        # Case 4: First query returns peek True but no identity;
        # second query returns tenant_count = 0
        (
            'admin1',
            {'id': 'user2'},
            [
                NeoResult(peek_value=True, single_data={'identity': None}),
                NeoResult(peek_value=True, single_data={'tenant_count': 0}),
            ],
            False,
        ),
        # Case 5: First query returns peek False (i.e. no employee match);
        # second query returns tenant_count = 1
        (
            'admin1',
            {'id': 'user2'},
            [
                NeoResult(peek_value=False, single_data={'identity': None}),
                NeoResult(peek_value=True, single_data={'tenant_count': 1}),
            ],
            True,
        ),
        # Case 6: First query returns peek False;
        # second query returns tenant_count = 0
        (
            'admin1',
            {'id': 'user2'},
            [
                NeoResult(peek_value=False, single_data={'identity': None}),
                NeoResult(peek_value=True, single_data={'tenant_count': 0}),
            ],
            False,
        ),
    ],
)
def test_can_reset_mfa(admin_identity_id, identity, neo_results, expected, monkeypatch):
    if neo_results is not None:
        # Patch get_session to return our NeoSession with the predetermined fake results.
        fake_session = NeoSession(neo_results)
        monkeypatch.setattr('users.models.identities.get_session', lambda: fake_session)
    else:
        # For self-reset, get_session should not be used; patch it to raise an error if called.
        monkeypatch.setattr(
            'users.models.identities.get_session',
            lambda: (_ for _ in ()).throw(Exception('get_session should not be called')),
        )
    result = can_reset_mfa(admin_identity_id, identity)
    assert result is expected