"""Test JWTAuth Utils."""

import pytest

from jwtauth.constants import (
    DEFAULT_ALGORITHMS,
    DEFAULT_JWKS_LIFESPAN,
    DEFAULT_LEEWAY,
    DEFAULT_OPTIONS,
    PROD_API_AUDIENCE,
    PROD_AUDIENCE,
    PROD_ISSUERS,
    QA_ISSUERS,
)
from jwtauth.exceptions import JWTAuthError
from jwtauth.utils import (
    get_default_audience,
    get_default_issuer,
    get_default_jwks_url,
    get_token_string_from_headers,
    is_path_match_re,
    jwt_auth_enabled_for_env,
    jwt_auth_from_environment,
)


def test_get_default_jwks_url_env(monkeypatch: pytest.MonkeyPatch) -> None:
    """Test get_default_jwks_url uses first issuer from environment variables."""
    monkeypatch.setenv("AUTH_ISSUERS", "https://auth0.com/, https://oauth2.com/")

    jwks_url = get_default_jwks_url(environment="prod")

    assert jwks_url == "https://auth0.com/.well-known/jwks.json"


def test_get_default_jwks_url_qa(monkeypatch: pytest.MonkeyPatch) -> None:
    """Test get_default_jwks_url uses qa environment constant."""
    jwks_url = get_default_jwks_url(environment="qa")

    assert jwks_url == "https://qalogin.theorchard.com/.well-known/jwks.json"


def test_get_default_jwks_url_prod(monkeypatch: pytest.MonkeyPatch) -> None:
    """Test get_default_jwks_url uses prod environment constant."""
    jwks_url = get_default_jwks_url(environment="prod")

    assert jwks_url == "https://login.distroauth.com/.well-known/jwks.json"


def test_get_default_audience_qa(monkeypatch: pytest.MonkeyPatch) -> None:
    """Test get_default_audience uses qa environment constant."""
    audience = get_default_audience(environment="qa")

    assert audience == [
        "https://qa-ows.theorchard.io",
        "https://workstation.qaorch.com/api",
    ]


def test_get_default_audience_prod(monkeypatch: pytest.MonkeyPatch) -> None:
    """Test get_default_audience uses prod environment constant."""
    audience = get_default_audience(environment="prod")

    assert audience == [
        "https://prod-ows.theorchard.io",
        "https://workstation.theorchard.com/api",
    ]


@pytest.mark.parametrize(
    "environment, expected",
    [
        ("qa", QA_ISSUERS),
        ("prod", PROD_ISSUERS),
        ("dev", None),
    ],
)
def test_get_default_issuer(environment: str, expected: list[str] | None) -> None:
    """Test get_default_issuer."""
    issuer = get_default_issuer(environment=environment)

    assert issuer == expected


def test_jwt_auth_from_config_prod() -> None:
    """Test jwt_auth_from_environment for prod."""
    environment = "prod"

    jwt_auth = jwt_auth_from_environment(environment=environment)

    assert jwt_auth.jwks_url == get_default_jwks_url(environment)
    assert jwt_auth.jwks_lifespan == DEFAULT_JWKS_LIFESPAN
    assert jwt_auth.algorithms == DEFAULT_ALGORITHMS
    assert jwt_auth.audience == [PROD_AUDIENCE, PROD_API_AUDIENCE]
    assert jwt_auth.leeway == DEFAULT_LEEWAY
    assert jwt_auth.options == DEFAULT_OPTIONS


@pytest.mark.parametrize(
    "environment, environment_enabled, expected",
    [
        ("prod", "1", True),
        ("prod", "", True),
        ("prod", "1", True),
        ("prod", "", True),
        ("dev", "", False),
        ("dev", "1", True),
    ],
)
def test_jwt_auth_enabled_for_env(
    monkeypatch: pytest.MonkeyPatch,
    environment: str,
    environment_enabled: str,
    expected: bool,
) -> None:
    """Test jwt_auth_enabled_for_env."""
    if environment_enabled:
        monkeypatch.setenv("JWT_AUTH_ENABLED", environment_enabled)

    actual = jwt_auth_enabled_for_env(environment)

    assert actual == expected


def test_get_token_string_missing_authorization() -> None:
    """Test get_token_string_from_headers when headers are empty."""
    with pytest.raises(JWTAuthError) as exc_info:
        get_token_string_from_headers({})

    assert exc_info.value.message == 'Missing "Authorization" in headers.'
    assert exc_info.value.code == "missing_authorization"


def test_get_token_string_invalid_authorization_header() -> None:
    """Test get_token_string_from_headers when Authorization is invalid."""
    with pytest.raises(JWTAuthError) as exc_info:
        get_token_string_from_headers({"authorization": "secret"})

    assert exc_info.value.message == 'Invalid "Authorization" header.'
    assert exc_info.value.code == "invalid_authorization"


def test_get_token_string_invalid_authorization_token_type() -> None:
    """Test get_token_string_from_headers when Authorization is invalid token type."""
    with pytest.raises(JWTAuthError) as exc_info:
        get_token_string_from_headers({"authorization": "jwt secret"})

    assert exc_info.value.message == 'Invalid "Authorization" token type.'
    assert exc_info.value.code == "invalid_authorization_token_type"


@pytest.mark.parametrize(
    "path, match, expected",
    [
        ("/hello/", ["/hello/"], True),
        ("/health", ["/_healthcheck"], False),
        ("/static/image.jpg", ["/static/*"], True),
        ("/any", ["/.+"], True),
        ("/any", None, False),
    ],
)
def test_is_url_path_match_re(
    path: str, match: list[str] | None, expected: bool
) -> None:
    """Test is_path_match_re."""
    assert is_path_match_re(path, match=match) == expected