from __future__ import annotations

import pytest

from app.domains.data_access import constants as c


@pytest.mark.parametrize((
    "axis",
    "canonical",
), [
    ("domain", c.DOMAIN_DATA_ACCESS),
    ("provider", c.PROVIDER_BIGQUERY),
    ("resource_type", c.RESOURCE_TYPE_DATASET),
    ("principal_type", c.PRINCIPAL_TYPE_GOOGLE_GROUP),
    ("principal_type", c.PRINCIPAL_TYPE_GOOGLE_USER),
    ("entitlement", c.ENTITLEMENT_READ),
    ("approval_flow", c.APPROVAL_FLOW_DATA_ACCESS_GROUP_GRANT),
    ("approval_flow", c.APPROVAL_FLOW_DATA_ACCESS_PERSONAL_GRANT),
])
def test_v1_canonical_values_are_accepted(axis: str, canonical: str) -> None:
    assert c.assert_canonical(axis, canonical) == canonical


@pytest.mark.parametrize((
    "axis",
    "alias",
), [
    ("domain", "cmdb_data_access"),
    ("provider", "gcp"),
    ("provider", "google_cloud"),
    ("resource_type", "project"),
    ("principal_type", "user"),
    ("principal_type", "person"),
    ("principal_type", "service_account"),
    ("entitlement", "roles/bigquery.dataViewer"),
    ("entitlement", "bigquery.jobUser"),
    ("approval_flow", "cmdb_data_access"),
])
def test_forbidden_aliases_are_rejected(axis: str, alias: str) -> None:
    with pytest.raises(ValueError, match="forbidden"):
        c.assert_canonical(axis, alias)


def test_required_principal_and_owner_field_names_are_frozen() -> None:
    assert c.PRINCIPAL_IDENTITY_FIELDS == (
        "principal_id",
        "principal_type_snapshot",
        "principal_subject_snapshot",
        "principal_email_group_id",
        "principal_google_group_id_snapshot",
        "principal_email_snapshot",
    )
    assert c.RESOURCE_OWNER_FIELDS == (
        "owner_person_id",
        "owner_source",
        "source_version",
        "source_etag",
    )


@pytest.mark.parametrize("field", [
    "email",
    "primary_email",
    "principal_email",
    "principal_email_snapshot",
    "group_email",
    "aliases",
])
def test_primary_email_cannot_be_semantic_principal_key(field: str) -> None:
    with pytest.raises(ValueError, match="forbidden"):
        c.assert_semantic_principal_field(field)


def test_principal_id_is_the_semantic_principal_key() -> None:
    assert (
        c.assert_semantic_principal_field("principal_id")
        == "principal_id"
    )


@pytest.mark.parametrize("field", [
    "alias",
    "aliases",
    "principal_alias",
    "google_group_alias",
])
def test_aliases_cannot_be_provider_member_source(field: str) -> None:
    with pytest.raises(ValueError, match="forbidden"):
        c.assert_provider_member_email_field(field)


def test_principal_email_snapshot_is_provider_member_source() -> None:
    assert (
        c.assert_provider_member_email_field("principal_email_snapshot")
        == "principal_email_snapshot"
    )


@pytest.mark.parametrize("field", [
    "catalog_owner_person_id",
    "catalog_owner_email",
    "bootstrap_owner_person_id",
    "bootstrap_owner_email",
    "raw_catalog_owner",
    "raw_bootstrap_owner",
])
def test_raw_catalog_or_bootstrap_owner_fields_cannot_authorize(
    field: str,
) -> None:
    with pytest.raises(ValueError, match="forbidden"):
        c.assert_runtime_owner_authority_field(field)


def test_projected_owner_person_id_is_runtime_authority() -> None:
    assert (
        c.assert_runtime_owner_authority_field("owner_person_id")
        == "owner_person_id"
    )