from __future__ import annotations

import uuid
from inspect import signature

import pytest

from app.domains.data_access import constants as c
from app.domains.data_access.models import (
    EFFECT_DESIRED_PRESENT,
    EFFECT_MANAGED_REASON_GRANT_REQUEST,
    ENTITLEMENT_STATUS_ACTIVE,
    ENTITLEMENT_VERSION_V1,
    OWNER_RESOLUTION_RESOLVED,
    DataAccessEntitlement,
)
from app.domains.data_access.service import (
    DATA_ACCESS_COMPILER_VERSION,
    DataAccessCompilerError,
    DataAccessDryRunCompiledEffect,
    DataAccessService,
    ValidatedGoogleGroupPrincipal,
    ValidatedRequestableDatasetResource,
)


def _resource(
    *,
    provider: str = c.PROVIDER_BIGQUERY,
    resource_type: str = c.RESOURCE_TYPE_DATASET,
    table_id: str | None = None,
) -> ValidatedRequestableDatasetResource:
    return ValidatedRequestableDatasetResource(
        resource_id=uuid.uuid4(),
        provider=provider,
        resource_type=resource_type,
        project_id="helix-data-prod",
        dataset_id="finance",
        owner_person_id=str(uuid.uuid4()),
        owner_resolution_status=OWNER_RESOLUTION_RESOLVED,
        owner_authority_enabled=True,
        source_version="catalog-2026-06-10",
        source_etag="etag-finance",
        table_id=table_id,
    )


def _principal(
    *,
    primary_email_snapshot: str = "analytics-readers@example.com",
    provider_member: str | None = None,
) -> ValidatedGoogleGroupPrincipal:
    provider_member = provider_member or (
        f"{c.BIGQUERY_GROUP_MEMBER_PREFIX}{primary_email_snapshot.lower()}"
    )
    return ValidatedGoogleGroupPrincipal(
        principal_email_group_id=uuid.uuid4(),
        requested_email_group_id=uuid.uuid4(),
        google_group_id="google-group-analytics",
        primary_email_snapshot=primary_email_snapshot,
        provider_member=provider_member,
        resolved_via="active_primary_email",
    )


def _entitlement(
    *,
    entitlement: str = c.ENTITLEMENT_READ,
    provider_member_prefix: str = c.BIGQUERY_GROUP_MEMBER_PREFIX,
    provider_role: str = c.BIGQUERY_DATA_VIEWER_ROLE,
    requestable: bool = True,
    status: str = ENTITLEMENT_STATUS_ACTIVE,
) -> DataAccessEntitlement:
    return DataAccessEntitlement(
        id=uuid.uuid4(),
        domain=c.DOMAIN_DATA_ACCESS,
        provider=c.PROVIDER_BIGQUERY,
        resource_type=c.RESOURCE_TYPE_DATASET,
        principal_type=c.PRINCIPAL_TYPE_GOOGLE_GROUP,
        entitlement=entitlement,
        version=ENTITLEMENT_VERSION_V1,
        provider_member_prefix=provider_member_prefix,
        provider_role=provider_role,
        requestable=requestable,
        status=status,
    )


def test_dry_run_compiles_exact_bigquery_dataset_read_effect() -> None:
    resource = _resource()
    principal = _principal()
    entitlement = _entitlement()

    effect = DataAccessService().compile_bigquery_dataset_read_dry_run(
        resource,
        principal,
        entitlement,
    )

    assert isinstance(effect, DataAccessDryRunCompiledEffect)
    assert effect.resource_id == resource.resource_id
    assert effect.principal_email_group_id == principal.principal_email_group_id
    assert effect.principal_google_group_id_snapshot == principal.google_group_id
    assert effect.principal_email_snapshot == "analytics-readers@example.com"
    assert effect.entitlement_id == entitlement.id
    assert effect.provider == c.PROVIDER_BIGQUERY
    assert effect.resource_type == c.RESOURCE_TYPE_DATASET
    assert effect.target_project_id == "helix-data-prod"
    assert effect.target_dataset_id == "finance"
    assert effect.target_table_id is None
    assert effect.provider_member == "group:analytics-readers@example.com"
    assert effect.provider_role == c.BIGQUERY_DATA_VIEWER_ROLE
    assert effect.desired_state == EFFECT_DESIRED_PRESENT
    assert effect.entitlement_version_snapshot == ENTITLEMENT_VERSION_V1
    assert effect.resource_source_version_snapshot == "catalog-2026-06-10"
    assert effect.resource_source_etag_snapshot == "etag-finance"
    assert effect.compiler_version == DATA_ACCESS_COMPILER_VERSION
    assert effect.managed_reason == EFFECT_MANAGED_REASON_GRANT_REQUEST
    assert effect.already_present_at_first_apply is False


def test_dry_run_compiles_exact_bigquery_table_read_effect() -> None:
    resource = _resource(
        resource_type=c.RESOURCE_TYPE_TABLE,
        table_id="account_daily",
    )

    effect = DataAccessService().compile_bigquery_dataset_read_dry_run(
        resource,
        _principal(),
        _entitlement(),
    )

    assert effect.resource_type == c.RESOURCE_TYPE_TABLE
    assert effect.target_project_id == "helix-data-prod"
    assert effect.target_dataset_id == "finance"
    assert effect.target_table_id == "account_daily"


def test_dry_run_recompiles_from_primary_email_snapshot_not_provider_member_input() -> None:
    principal = _principal(
        primary_email_snapshot="Analytics-Renamed@Example.COM",
        provider_member="group:alias-or-stale-value@example.com",
    )

    effect = DataAccessService().compile_bigquery_dataset_read_dry_run(
        _resource(),
        principal,
        _entitlement(),
    )

    assert effect.provider_member == "group:analytics-renamed@example.com"
    assert effect.provider_member != principal.provider_member
    assert effect.principal_email_snapshot == "analytics-renamed@example.com"


def test_dry_run_signature_accepts_no_provider_member_or_role_override() -> None:
    params = signature(
        DataAccessService.compile_bigquery_dataset_read_dry_run,
    ).parameters

    assert "provider_member" not in params
    assert "provider_role" not in params


@pytest.mark.parametrize(
    ("provider", "resource_type"),
    [
        ("gcp", c.RESOURCE_TYPE_DATASET),
        (c.PROVIDER_BIGQUERY, "project"),
    ],
)
def test_dry_run_rejects_unsupported_resource_combinations(
    provider: str,
    resource_type: str,
) -> None:
    with pytest.raises(DataAccessCompilerError) as exc_info:
        DataAccessService().compile_bigquery_dataset_read_dry_run(
            _resource(provider=provider, resource_type=resource_type),
            _principal(),
            _entitlement(),
        )

    exc = exc_info.value
    assert exc.reason == "unsupported_resource"
    assert exc.field == "resource"
    assert exc.status_code == 422


@pytest.mark.parametrize(
    "entitlement",
    [
        _entitlement(entitlement="viewer"),
        _entitlement(provider_role="roles/bigquery.jobUser"),
        _entitlement(provider_member_prefix="user:"),
        _entitlement(requestable=False),
        _entitlement(status="disabled"),
    ],
)
def test_dry_run_rejects_unsupported_entitlement_combinations(
    entitlement: DataAccessEntitlement,
) -> None:
    with pytest.raises(DataAccessCompilerError) as exc_info:
        DataAccessService().compile_bigquery_dataset_read_dry_run(
            _resource(),
            _principal(),
            entitlement,
        )

    exc = exc_info.value
    assert exc.reason == "unsupported_entitlement"
    assert exc.field == "entitlement"
    assert exc.status_code == 422


@pytest.mark.parametrize(
    "principal",
    [
        _principal(primary_email_snapshot=" "),
        ValidatedGoogleGroupPrincipal(
            principal_email_group_id=uuid.uuid4(),
            requested_email_group_id=uuid.uuid4(),
            google_group_id=" ",
            primary_email_snapshot="analytics-readers@example.com",
            provider_member="group:analytics-readers@example.com",
            resolved_via="active_primary_email",
        ),
    ],
)
def test_dry_run_rejects_invalid_principal_snapshot(
    principal: ValidatedGoogleGroupPrincipal,
) -> None:
    with pytest.raises(DataAccessCompilerError) as exc_info:
        DataAccessService().compile_bigquery_dataset_read_dry_run(
            _resource(),
            principal,
            _entitlement(),
        )

    exc = exc_info.value
    assert exc.reason == "invalid_principal_snapshot"
    assert exc.field == "principal"