"""
Example integration tests to validate endpoint using different
authorization headers.
"""

import pytest
import requests


def test_accounts_dataloader_authorized_admin_profile_headers(
    authorized_admin_profile_headers: dict[str, str],
) -> None:
    """Test the /account/dataloader endpoint with Profile headers."""
    response = requests.post(
        "https://qa-ows-abacus-account.theorchard.io/account/dataloader",
        json=[1],
        headers=authorized_admin_profile_headers,
    )

    assert response.status_code == 200
    # Exercise left to the reader: validate the response.


@pytest.mark.xfail(
    reason="The fixture PP identity does have account/view_abacus_account_info access"
)
def test_accounts_dataloader_authorized_pp_headers(
    authorized_pp_headers: dict[str, str],
) -> None:
    """Test the /account/dataloader endpoint with PP auth headers.

    This request returns a 403 because `authorized_pp_headers` does not have
    an identity enabled in Permissions Platform (PP). In a real integration test,
    you'd create a user with a valid identity and PP roles in `pdp-backfill`.

    For example:
    - https://github.com/theorchard/pdp-backfill/blob/master/pdp_qa_refresh/09_a360_integration_tests.csv
    """
    response = requests.post(
        "https://qa-ows-abacus-account.theorchard.io/account/dataloader",
        json=[1],
        headers=authorized_pp_headers,
    )

    assert response.status_code == 200
    # Exercise left to the reader: validate the response


def test_accounts_dataloader_unauthorized_headers(
    unauthorized_headers: dict[str, str],
) -> None:
    """Test the /account/dataloader endpoint with invalid headers."""
    response = requests.post(
        "https://qa-ows-abacus-account.theorchard.io/account/dataloader",
        json=[1],
        headers=unauthorized_headers,
    )

    assert response.status_code == 403