import base64
import json
from unittest.mock import MagicMock

from cryptography.hazmat.primitives import hashes, padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC

from backend.adapters.snowflake import generate_profile_link
from configuration.local_connection import get_connection_parameters

TEST_SECRET = "nEK^lc{n(RT>S;lujne|wbdP;IGNLTir@>IgL6kG t#?PIof^IRn;kk;<T%P(5r7uxYVZ)v c4777928751ecf18"


def _mock_session(user: str = "test_user@example.com") -> MagicMock:
    session = MagicMock()
    session.get_current_user.return_value = f'"{user}"'
    return session


def _decrypt_token(token: str) -> dict:  # type: ignore[type-arg]
    signing_key_b85, password_b85, salt_hex = TEST_SECRET.split(" ")
    password = password_b85.encode("utf-8")
    salt = bytes.fromhex(salt_hex)
    kdf = PBKDF2HMAC(algorithm=hashes.SHA1(), length=32, salt=salt, iterations=1000)
    encryption_key = kdf.derive(password)

    parts = token.split(".")
    padded = parts[1] + "=" * (4 - len(parts[1]) % 4)
    jwt_body = json.loads(base64.urlsafe_b64decode(padded))
    payload_str = jwt_body["payload"]

    iv = bytes.fromhex(payload_str[:32])
    ciphertext = base64.b64decode(payload_str[32:])
    cipher = Cipher(algorithms.AES256(encryption_key), modes.CBC(iv))
    decryptor = cipher.decryptor()
    plaintext_padded = decryptor.update(ciphertext) + decryptor.finalize()
    unpadder = padding.PKCS7(128).unpadder()
    plaintext = unpadder.update(plaintext_padded) + unpadder.finalize()
    return json.loads(plaintext)  # type: ignore[no-any-return]


def test_connection() -> None:
    params = get_connection_parameters("streamlit_backoffice_connection")
    assert (isinstance(params, dict), bool(params)) == (True, True)


def test_generate_profile_link_uses_profile_id(monkeypatch: MagicMock) -> None:
    monkeypatch.setenv("PREFERENCE_CENTER_SECRET_KEY", TEST_SECRET)
    session = _mock_session()

    link = generate_profile_link(session, "abc-123", "QA")

    token = link.split("/en/profile/")[1].split("/settings")[0]
    payload = _decrypt_token(token)
    assert payload["profileId"] == "abc-123"
    assert "crmId" not in payload


def test_generate_profile_link_uses_crm_id_when_provided(
    monkeypatch: MagicMock,
) -> None:
    monkeypatch.setenv("PREFERENCE_CENTER_SECRET_KEY", TEST_SECRET)
    session = _mock_session()

    link = generate_profile_link(session, "abc-123", "QA", crm_id="crm-456")

    token = link.split("/en/profile/")[1].split("/settings")[0]
    payload = _decrypt_token(token)
    assert payload["crmId"] == "crm-456"
    assert "profileId" not in payload


def test_generate_profile_link_includes_impersonated_by(monkeypatch: MagicMock) -> None:
    monkeypatch.setenv("PREFERENCE_CENTER_SECRET_KEY", TEST_SECRET)
    session = _mock_session(user="rbomberg@sonymusic-pde.com")

    link = generate_profile_link(session, "abc-123", "QA")

    token = link.split("/en/profile/")[1].split("/settings")[0]
    payload = _decrypt_token(token)
    assert payload["impersonatedBy"] == "rbomberg@sonymusic-pde.com"


def test_generate_profile_link_qa_base_url(monkeypatch: MagicMock) -> None:
    monkeypatch.setenv("PREFERENCE_CENTER_SECRET_KEY", TEST_SECRET)
    session = _mock_session()

    link = generate_profile_link(session, "abc-123", "QA")

    assert link.startswith("https://qa-preferences.theorchard.io/en/profile/")
    assert link.endswith("/settings")


def test_generate_profile_link_prod_base_url(monkeypatch: MagicMock) -> None:
    monkeypatch.setenv("PREFERENCE_CENTER_SECRET_KEY", TEST_SECRET)
    session = _mock_session()

    link = generate_profile_link(session, "abc-123", "PROD")

    assert link.startswith("https://fan-preferences.sonymusic.com/en/profile/")
    assert link.endswith("/settings")