from __future__ import annotations

import uuid
from inspect import getsource, signature

import pytest

from app.domains.data_access import constants as c
from app.domains.data_access.approval_flow import DataAccessApprovalFlow
from app.domains.data_access.models import (
    ENTITLEMENT_STATUS_ACTIVE,
    ENTITLEMENT_VERSION_V1,
    OWNER_RESOLUTION_RESOLVED,
    DataAccessEntitlement,
)
from app.domains.data_access.service import (
    DATA_ACCESS_COMPILER_VERSION,
    DATA_ACCESS_FEISHU_PAYLOAD_VERSION,
    DataAccessCompilerError,
    DataAccessFeishuPayloadError,
    DataAccessFeishuSubmissionPayload,
    DataAccessService,
    ValidatedGoogleGroupPrincipal,
    ValidatedRequestableDatasetResource,
)

_DEFAULT_OWNER = object()


def _flow(
    *,
    flow_key: str = c.APPROVAL_FLOW_DATA_ACCESS_GROUP_GRANT,
    external_code: str = "DATA-ACCESS-GROUP-GRANT-CODE",
) -> DataAccessApprovalFlow:
    return DataAccessApprovalFlow(
        flow_key=flow_key,
        external_code=external_code,
        payload_schema={
            "request_summary": "widget-request-summary",
            "requested_access": "widget-requested-access",
            "dataset_list": "widget-dataset-list",
            "business_reason": "widget-business-reason",
            "detail_url": "widget-detail-url",
        },
    )


def _resource(
    *,
    resource_id: uuid.UUID | None = None,
    dataset_id: str = "finance",
    owner_person_id: str | None | object = _DEFAULT_OWNER,
    owner_authority_enabled: bool = True,
    provider: str = c.PROVIDER_BIGQUERY,
    resource_type: str = c.RESOURCE_TYPE_DATASET,
    description: str | None = None,
) -> ValidatedRequestableDatasetResource:
    resolved_owner_person_id = (
        str(uuid.uuid4()) if owner_person_id is _DEFAULT_OWNER else owner_person_id
    )
    return ValidatedRequestableDatasetResource(
        resource_id=resource_id or uuid.uuid4(),
        provider=provider,
        resource_type=resource_type,
        project_id="helix-data-prod",
        dataset_id=dataset_id,
        owner_person_id=resolved_owner_person_id,
        owner_resolution_status=OWNER_RESOLUTION_RESOLVED,
        owner_authority_enabled=owner_authority_enabled,
        source_version=f"catalog-2026-06-10-{dataset_id}",
        source_etag=f"etag-{dataset_id}",
        description=description,
    )


def _principal(
    *,
    primary_email_snapshot: str = "Analytics-Readers@Example.COM",
    provider_member: str = "group:stale-alias@example.com",
) -> ValidatedGoogleGroupPrincipal:
    return ValidatedGoogleGroupPrincipal(
        principal_email_group_id=uuid.uuid4(),
        requested_email_group_id=uuid.uuid4(),
        google_group_id="google-group-analytics",
        primary_email_snapshot=primary_email_snapshot,
        provider_member=provider_member,
        resolved_via="active_primary_email",
    )


def _entitlement(
    *,
    entitlement: str = c.ENTITLEMENT_READ,
    provider_member_prefix: str = c.BIGQUERY_GROUP_MEMBER_PREFIX,
    provider_role: str = c.BIGQUERY_DATA_VIEWER_ROLE,
    requestable: bool = True,
    status: str = ENTITLEMENT_STATUS_ACTIVE,
) -> DataAccessEntitlement:
    return DataAccessEntitlement(
        id=uuid.uuid4(),
        domain=c.DOMAIN_DATA_ACCESS,
        provider=c.PROVIDER_BIGQUERY,
        resource_type=c.RESOURCE_TYPE_DATASET,
        principal_type=c.PRINCIPAL_TYPE_GOOGLE_GROUP,
        entitlement=entitlement,
        version=ENTITLEMENT_VERSION_V1,
        provider_member_prefix=provider_member_prefix,
        provider_role=provider_role,
        requestable=requestable,
        status=status,
    )


def test_builds_human_readable_feishu_fields_and_keeps_audit_payload() -> None:
    owner_id = str(uuid.uuid4())
    no_owner_resource = _resource(
        dataset_id="people",
        owner_person_id=None,
        owner_authority_enabled=False,
    )
    resources = [
        _resource(
            dataset_id="finance",
            owner_person_id=owner_id,
            description=(
                "Finance reporting marts for quarterly close and analytics."
            ),
        ),
        no_owner_resource,
    ]
    principal = _principal()
    entitlement = _entitlement()

    payload = DataAccessService().build_feishu_submission_payload(
        flow=_flow(external_code="  DATA-ACCESS-GROUP-GRANT-CODE  "),
        resources=resources,
        principal=principal,
        entitlement=entitlement,
        business_reason="  quarterly finance review  ",
        detail_url="/data-access/requests/draft-123",
    )

    assert isinstance(payload, DataAccessFeishuSubmissionPayload)
    assert payload.flow_key == c.APPROVAL_FLOW_DATA_ACCESS_GROUP_GRANT
    assert payload.external_code == "DATA-ACCESS-GROUP-GRANT-CODE"
    assert payload.payload_version == DATA_ACCESS_FEISHU_PAYLOAD_VERSION
    assert payload.dataset_count == 2
    assert payload.business_reason == "quarterly finance review"
    assert payload.detail_url == "/data-access/requests/draft-123"

    fields = payload.to_submission_fields()
    assert set(fields) == {
        "request_summary",
        "requested_access",
        "dataset_list",
        "business_reason",
        "detail_url",
    }
    assert fields["request_summary"] == (
        "Google Group analytics-readers@example.com is requesting "
        "read access to 2 BigQuery datasets."
    )
    assert fields["requested_access"] == (
        "Grant BigQuery data viewer to Google Group "
        "analytics-readers@example.com."
    )
    assert "1. helix-data-prod.finance" in fields["dataset_list"]
    assert (
        "Description: Finance reporting marts for quarterly close and analytics."
        in fields["dataset_list"]
    )
    assert "2. helix-data-prod.people" in fields["dataset_list"]
    assert "Planned change: grant access as BigQuery data viewer" in (
        fields["dataset_list"]
    )
    assert "Catalog version: catalog-2026-06-10-finance" in (
        fields["dataset_list"]
    )
    assert "Owner check: resolved; owner authority disabled" in (
        fields["dataset_list"]
    )
    assert fields["business_reason"] == "quarterly finance review"
    assert fields["detail_url"] == "/data-access/requests/draft-123"
    assert "audit_context" not in fields
    assert "principal_email_group_id" not in fields["request_summary"]
    assert "provider_member" not in fields["dataset_list"]
    assert "{" not in "\n".join(fields.values())

    audit_fields = payload.to_audit_fields()
    assert audit_fields["payload_version"] == DATA_ACCESS_FEISHU_PAYLOAD_VERSION
    assert audit_fields["dataset_count"] == 2
    assert audit_fields["business_reason"] == "quarterly finance review"
    assert audit_fields["detail_url"] == "/data-access/requests/draft-123"

    semantic_intent = audit_fields["semantic_intent"]
    assert semantic_intent == {
        "domain": c.DOMAIN_DATA_ACCESS,
        "provider": c.PROVIDER_BIGQUERY,
        "resource_type": c.RESOURCE_TYPE_DATASET,
        "principal_type": c.PRINCIPAL_TYPE_GOOGLE_GROUP,
        "entitlement": c.ENTITLEMENT_READ,
        "approval_flow": c.APPROVAL_FLOW_DATA_ACCESS_GROUP_GRANT,
        "principal_email_group_id": str(principal.principal_email_group_id),
        "principal_google_group_id_snapshot": "google-group-analytics",
        "principal_email_snapshot": "analytics-readers@example.com",
        "entitlement_id": str(entitlement.id),
        "entitlement_version": ENTITLEMENT_VERSION_V1,
    }

    owner_context = audit_fields["dataset_owner_context"]
    assert owner_context == [
        {
            "resource_id": str(resources[0].resource_id),
            "provider": c.PROVIDER_BIGQUERY,
            "resource_type": c.RESOURCE_TYPE_DATASET,
            "project_id": "helix-data-prod",
            "dataset_id": "finance",
            "owner_person_id": owner_id,
            "owner_resolution_status": OWNER_RESOLUTION_RESOLVED,
            "owner_authority_enabled": True,
            "source_version": "catalog-2026-06-10-finance",
            "source_etag": "etag-finance",
            "description": (
                "Finance reporting marts for quarterly close and analytics."
            ),
        },
        {
            "resource_id": str(no_owner_resource.resource_id),
            "provider": c.PROVIDER_BIGQUERY,
            "resource_type": c.RESOURCE_TYPE_DATASET,
            "project_id": "helix-data-prod",
            "dataset_id": "people",
            "owner_person_id": None,
            "owner_resolution_status": OWNER_RESOLUTION_RESOLVED,
            "owner_authority_enabled": False,
            "source_version": "catalog-2026-06-10-people",
            "source_etag": "etag-people",
            "description": None,
        },
    ]

    preview = audit_fields["compiled_preview"]
    assert preview == [
        {
            "resource_id": str(resources[0].resource_id),
            "target_project_id": "helix-data-prod",
            "target_dataset_id": "finance",
            "provider_member": "group:analytics-readers@example.com",
            "provider_role": c.BIGQUERY_DATA_VIEWER_ROLE,
            "desired_state": "present",
            "entitlement_version_snapshot": ENTITLEMENT_VERSION_V1,
            "resource_source_version_snapshot": "catalog-2026-06-10-finance",
            "resource_source_etag_snapshot": "etag-finance",
            "compiler_version": DATA_ACCESS_COMPILER_VERSION,
            "managed_reason": "grant_request",
            "already_present_at_first_apply": False,
        },
        {
            "resource_id": str(no_owner_resource.resource_id),
            "target_project_id": "helix-data-prod",
            "target_dataset_id": "people",
            "provider_member": "group:analytics-readers@example.com",
            "provider_role": c.BIGQUERY_DATA_VIEWER_ROLE,
            "desired_state": "present",
            "entitlement_version_snapshot": ENTITLEMENT_VERSION_V1,
            "resource_source_version_snapshot": "catalog-2026-06-10-people",
            "resource_source_etag_snapshot": "etag-people",
            "compiler_version": DATA_ACCESS_COMPILER_VERSION,
            "managed_reason": "grant_request",
            "already_present_at_first_apply": False,
        },
    ]
    assert "provider_member" not in semantic_intent
    assert preview[0]["provider_member"] != principal.provider_member


def test_payload_builder_signature_has_no_db_or_provider_submission_inputs() -> None:
    params = signature(DataAccessService.build_feishu_submission_payload).parameters

    assert "db" not in params
    assert "session" not in params
    assert "instance_code" not in params
    assert "open_user_id" not in params
    assert "provider_member" not in params
    assert "provider_role" not in params


@pytest.mark.parametrize(
    ("kwargs", "reason", "field"),
    [
        (
            {"resources": []},
            "empty_dataset_selection",
            "resources",
        ),
        (
            {"flow": _flow(flow_key="cloud_scope_request")},
            "unsupported_flow",
            "flow_key",
        ),
        (
            {"flow": _flow(external_code=" ")},
            "missing_external_code",
            "external_code",
        ),
        (
            {"business_reason": " "},
            "missing_required_field",
            "business_reason",
        ),
        (
            {"detail_url": " "},
            "missing_required_field",
            "detail_url",
        ),
        (
            {"detail_url": "javascript:alert(1)"},
            "invalid_detail_url",
            "detail_url",
        ),
        (
            {"detail_url": "//evil.example.com/data-access/requests/1"},
            "invalid_detail_url",
            "detail_url",
        ),
        (
            {"detail_url": "https://"},
            "invalid_detail_url",
            "detail_url",
        ),
        (
            {"detail_url": "http://"},
            "invalid_detail_url",
            "detail_url",
        ),
        (
            {"detail_url": "https:///data-access/requests/1"},
            "invalid_detail_url",
            "detail_url",
        ),
        (
            {"detail_url": "/data-access/requests/1\nX-Injected: true"},
            "invalid_single_line_field",
            "detail_url",
        ),
    ],
)
def test_payload_builder_rejects_invalid_submission_inputs(
    kwargs: dict[str, object],
    reason: str,
    field: str,
) -> None:
    resource = _resource()
    args = {
        "flow": _flow(),
        "resources": [resource],
        "principal": _principal(),
        "entitlement": _entitlement(),
        "business_reason": "request access",
        "detail_url": "https://helix.example.com/data-access/requests/draft",
    }
    args.update(kwargs)

    with pytest.raises(DataAccessFeishuPayloadError) as exc_info:
        DataAccessService().build_feishu_submission_payload(**args)

    exc = exc_info.value
    assert exc.reason == reason
    assert exc.field == field
    assert exc.status_code == 422


def test_payload_builder_rejects_duplicate_dataset_resources() -> None:
    resource_id = uuid.uuid4()

    with pytest.raises(DataAccessFeishuPayloadError) as exc_info:
        DataAccessService().build_feishu_submission_payload(
            flow=_flow(),
            resources=[
                _resource(resource_id=resource_id),
                _resource(resource_id=resource_id),
            ],
            principal=_principal(),
            entitlement=_entitlement(),
            business_reason="request access",
            detail_url="/data-access/requests/draft",
        )

    assert exc_info.value.reason == "duplicate_dataset"
    assert exc_info.value.field == "resources"


@pytest.mark.parametrize(
    "entitlement",
    [
        _entitlement(entitlement="viewer"),
        _entitlement(provider_role="roles/bigquery.jobUser"),
        _entitlement(provider_member_prefix="user:"),
        _entitlement(requestable=False),
        _entitlement(status="disabled"),
    ],
)
def test_payload_builder_uses_dry_run_compiler_and_rejects_bad_entitlements(
    entitlement: DataAccessEntitlement,
) -> None:
    with pytest.raises(DataAccessCompilerError) as exc_info:
        DataAccessService().build_feishu_submission_payload(
            flow=_flow(),
            resources=[_resource()],
            principal=_principal(),
            entitlement=entitlement,
            business_reason="request access",
            detail_url="/data-access/requests/draft",
        )

    assert exc_info.value.reason == "unsupported_entitlement"


def test_payload_builder_rejects_non_bigquery_dataset_resource() -> None:
    with pytest.raises(DataAccessCompilerError) as exc_info:
        DataAccessService().build_feishu_submission_payload(
            flow=_flow(),
            resources=[_resource(resource_type="table")],
            principal=_principal(),
            entitlement=_entitlement(),
            business_reason="request access",
            detail_url="/data-access/requests/draft",
        )

    assert exc_info.value.reason == "unsupported_resource"


def test_feishu_payload_builder_does_not_submit_or_persist() -> None:
    builder_text = getsource(DataAccessService.build_feishu_submission_payload)

    assert "FeishuApprovalClient" not in builder_text
    assert "create_instance(" not in builder_text
    assert "submit_approval(" not in builder_text
    assert "ApprovalRequest" not in builder_text
    assert "DataAccessRequest(" not in builder_text
    assert "DataAccessCompiledEffect(" not in builder_text