from unittest import mock

import faker
import pytest

from fansifter_common.auth.account import Account
from fansifter_common.auth.authorization import AuthorizationBackend
from fansifter_common.auth.services import AuthService
from fansifter_common.auth.types import Permission

from tests.factories import ResourceFactory


@pytest.fixture
def authorization_backend_mock() -> mock.MagicMock:
    return mock.MagicMock(spec=AuthorizationBackend)


@pytest.fixture
def auth_service(
    authorization_backend_mock: mock.MagicMock,
) -> AuthService:
    return AuthService(authorization_backend=authorization_backend_mock)


def test_authorize_for_permission(
    auth_service: AuthService,
    authorization_backend_mock: mock.MagicMock,
    faker: faker.Faker,
) -> None:
    identity_id = faker.pystr()
    resource_type, action = faker.pystr(), faker.pystr()

    auth_service.authorize_for_permission(
        identity_id, permission=Permission(resource_type, action)
    )

    authorization_backend_mock.authorize_for_resource_type_action.assert_called_once_with(
        identity_id, resource_type=resource_type, action=action
    )


def test_authorize_account(
    auth_service: AuthService,
    authorization_backend_mock: mock.MagicMock,
    faker: faker.Faker,
) -> None:
    identity_id = faker.pystr()
    resource_type, action = faker.pystr(), faker.pystr()
    permission = Permission(resource_type, action)
    account = Account(vendor_id=1, subaccount_id=0)

    auth_service.authorize_account(identity_id, permission=permission, account=account)

    authorization_backend_mock.authorize_account.assert_called_once_with(
        identity_id,
        resource_type=permission.resource_type,
        action=permission.action,
        account=account,
    )


def test_check_account_permission(
    auth_service: AuthService,
    authorization_backend_mock: mock.MagicMock,
    faker: faker.Faker,
) -> None:
    identity_id = faker.pystr()
    resource = ResourceFactory.build()
    account = Account(vendor_id=100, subaccount_id=0)
    permission = Permission(resource.resource_type, "view")

    auth_service.check_account_resource(
        identity_id,
        account=account,
        permission=permission,
        resource_id=resource.resource_id,
    )

    authorization_backend_mock.is_allowed_account_resource.assert_called_once_with(
        identity_id,
        account=account,
        resource_id=resource.resource_id,
        resource_type=resource.resource_type,
        action=permission.action,
        joint_ventures=None,
    )


def test_authorize_account_owned_resource(
    auth_service: AuthService,
    authorization_backend_mock: mock.MagicMock,
    faker: faker.Faker,
) -> None:
    identity_id = faker.pystr()
    resource = ResourceFactory.build()
    permission = Permission(resource.resource_type, "delete")
    account = Account(vendor_id=100, subaccount_id=0)

    auth_service.check_account_owned_resource(
        identity_id,
        account=account,
        permission=permission,
        resource_id=resource.resource_id,
        resource_identity_id=identity_id,
    )

    authorization_backend_mock.is_allowed_owned_resource.assert_called_once_with(
        identity_id,
        account=account,
        resource_identity_id=identity_id,
        resource_id=resource.resource_id,
        resource_type=resource.resource_type,
        action=permission.action,
    )


def test_authorize_owned_resource(
    auth_service: AuthService,
    authorization_backend_mock: mock.MagicMock,
    faker: faker.Faker,
) -> None:
    identity_id = faker.pystr()
    resource = ResourceFactory.build()
    permission = Permission(resource.resource_type, "delete")

    auth_service.check_owned_resource(
        identity_id,
        permission=permission,
        resource_id=resource.resource_id,
    )

    authorization_backend_mock.is_allowed_owned_resource.assert_called_once_with(
        identity_id,
        resource_identity_id=identity_id,
        resource_id=resource.resource_id,
        resource_type=resource.resource_type,
        action=permission.action,
        account=None,
    )


def test_get_account_access(
    auth_service: AuthService,
    authorization_backend_mock: mock.MagicMock,
    faker: faker.Faker,
) -> None:
    identity_id = faker.pystr()
    resource = ResourceFactory.build()
    permission = Permission(resource.resource_type, "view_email_target")

    auth_service.get_account_access_for_permission(
        identity_id,
        permission=permission,
    )

    authorization_backend_mock.get_account_access.assert_called_once_with(
        identity_id,
        resource_type=resource.resource_type,
        action=permission.action,
    )