"""Fixtures for testing."""

from collections.abc import Callable

import pytest

from jwtauth.testing import (
    JwtAuthSecretsManager,
    SecretLookupInfo,
)

# Include this line in the `root` test module or `conftest.py`
# to discover the jwtauth plugin.
pytest_plugins = ["jwtauth.testing.pytest_plugin"]


@pytest.fixture(scope="session")
def unauthorized_headers() -> dict[str, str]:
    """
    Invalid profile headers that should return a 403 error.
    """
    return {
        "Content-Type": "application/json",
        "Orchard-Requestor-Service": "graphql-abacus",
        "Orchard-Identity-Id": "2ae5d241-645e-4616-af28-d5ac9c2c8280",
        "Orchard-Profile-Type": "NoSuchProfile",
        "Orchard-Profile-Id": "1",
        "Orchard-Roles": "no.such.role",
    }


@pytest.fixture(scope="session")
def bearer_token_read_only_user(
    generate_bearer_token: Callable[..., str],
    jwtauth_secrets_manager: JwtAuthSecretsManager,
) -> str:
    """
    Generate a bearer token

    In this example we're using `PDP_TEST_USER_CREDENTIALS` as the
    'read-only' user. For a real integration test, you'll create secrets
    for the `User` credentials for a test user and an `Auth0` creds for the app.
    """
    return generate_bearer_token(
        get_user_creds_args=SecretLookupInfo(
            environment="qa",
            service_name="pdp-integration-test",
            secret_name="PDP_TEST_USER_CREDENTIALS",
        ),
        get_auth0_creds_args=SecretLookupInfo(
            environment="qa",
            service_name="pdp-integration-test",
            secret_name="PDP_TEST_APP_AUTH0_CREDENTIALS",
        ),
        secrets_manager=jwtauth_secrets_manager,
    )


@pytest.fixture(scope="session")
def authorized_admin_profile_headers() -> dict[str, str]:
    """Valid profile headers.

    This fixture will verify that the endpoint
    is backwards-compatible with existing profile headers.
    """
    return {
        "Content-Type": "application/json",
        "Orchard-Identity-Id": "00dc658e-94c1-49d3-8efd-0cd14eecded1",
        "Orchard-Profile-Id": "1",
        "Orchard-Profile-Type": "AbacusProfile",
        "Orchard-Roles": "administrator",
        "Orchard-Requestor-Service": "graphql-abacus",
    }


@pytest.fixture(scope="session")
def authorized_pp_headers(bearer_token_read_only_user: str) -> dict[str, str]:
    """Valid PP headers.

    This fixture will verify that the endpoint support PP authorization checks.
    """
    return {
        "Authorization": f"Bearer {bearer_token_read_only_user}",
        "Orchard-Requestor-Service": "graphql-abacus",
    }