"""Tests for the access checking helper functions."""

from unittest.mock import MagicMock, patch

from abacus_common_logic.utils.authorization import (
    PROFILE_TYPES_TO_CHECK,
    permissions_authorize_many_accounts,
)


@patch('abacus_common_logic.utils.authorization.get_accounts_for_profile')
def test_permissions_authorize_many_accounts_with_access(mock_get_accounts_for_profile):
    """Test checking access to many accounts when the client has access."""
    profile_type = 'LabelProfile'
    profile_id = 123
    account_ids = [1, 2]
    allowed_account_ids = [1, 2, 3]

    mock_ows_client = MagicMock()

    mock_get_accounts_for_profile.return_value = allowed_account_ids

    result = permissions_authorize_many_accounts(
        mock_ows_client, profile_type, profile_id, account_ids
    )

    mock_get_accounts_for_profile.assert_called_once_with(
        mock_ows_client, profile_type, profile_id
    )

    assert result


@patch('abacus_common_logic.utils.authorization.get_accounts_for_profile')
def test_permissions_authorize_many_accounts_with_full_access(
    mock_get_accounts_for_profile,
):
    """Test checking access to many accounts when the client has full catalog access."""
    profile_type = 'LabelProfile'
    profile_id = 123
    account_ids = [1, 2]
    allowed_account_ids = ['*']

    mock_ows_client = MagicMock()

    mock_get_accounts_for_profile.return_value = allowed_account_ids

    result = permissions_authorize_many_accounts(
        mock_ows_client, profile_type, profile_id, account_ids
    )

    mock_get_accounts_for_profile.assert_called_once_with(
        mock_ows_client, profile_type, profile_id
    )

    assert result


@patch('abacus_common_logic.utils.authorization.get_accounts_for_profile')
@patch('abacus_common_logic.utils.authorization.log')
def test_permissions_authorize_many_accounts_without_access(
    mock_log, mock_get_accounts_for_profile
):
    """Test checking access to many accounts when the client doesn't have access."""
    profile_type = 'LabelProfile'
    profile_id = 123
    account_ids = [1, 2]
    allowed_account_ids = [2, 3]

    mock_ows_client = MagicMock()

    mock_get_accounts_for_profile.return_value = allowed_account_ids

    result = permissions_authorize_many_accounts(
        mock_ows_client, profile_type, profile_id, account_ids
    )

    mock_get_accounts_for_profile.assert_called_once_with(
        mock_ows_client, profile_type, profile_id
    )

    mock_log.assert_called_once()
    assert mock_log.call_args.args[0] == 'warn'

    assert not result


@patch('abacus_common_logic.utils.authorization.get_accounts_for_profile')
def test_permissions_authorize_many_accounts_invalid_profile(
    mock_get_accounts_for_profile,
):
    """Test checking access to many accounts when the profile should not be checked."""
    profile_type = 'AbacusProfile'
    profile_id = 123
    account_ids = [1, 2]

    mock_ows_client = MagicMock()

    result = permissions_authorize_many_accounts(
        mock_ows_client, profile_type, profile_id, account_ids
    )

    mock_get_accounts_for_profile.assert_not_called()

    assert result


@patch('abacus_common_logic.utils.authorization.get_accounts_for_profile')
def test_permissions_authorize_many_accounts_override_profile_types_to_check(
    mock_get_accounts_for_profile,
):
    """Test checking access to many accounts when overriding the default profile types."""  # noqa: E501
    profile_type = 'NewProfile'
    profile_id = 123
    account_ids = [1, 2]
    allowed_account_ids = [1, 2]

    mock_ows_client = MagicMock()

    mock_get_accounts_for_profile.return_value = allowed_account_ids

    result = permissions_authorize_many_accounts(
        mock_ows_client,
        profile_type,
        profile_id,
        account_ids,
        profile_types_to_check=(PROFILE_TYPES_TO_CHECK + ['NewProfile']),
    )

    mock_get_accounts_for_profile.assert_called_once_with(
        mock_ows_client, profile_type, profile_id
    )

    assert result