"""Unit tests for the SuccessFactors auth layer."""
from __future__ import annotations

import base64
from xml.etree import ElementTree

import httpx
import pytest
import respx
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa

from app.identity.successfactors_auth import (
    BasicAuth,
    OAuth2ClientCredentialsAuth,
    OAuth2SamlBearerAuth,
    build_auth_from_config,
    build_signed_saml_assertion,
)


def _make_private_key_pem() -> str:
    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
    return key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption(),
    ).decode()


def test_basic_auth_sets_authorization_header():
    auth = BasicAuth(username="apiuser@MYCO", password="pw")
    request = httpx.Request("GET", "https://x.example.com/")
    import asyncio
    asyncio.run(auth.apply(request))
    header = request.headers["Authorization"]
    assert header.startswith("Basic ")
    decoded = base64.b64decode(header.removeprefix("Basic ").encode()).decode()
    assert decoded == "apiuser@MYCO:pw"


def test_basic_auth_rejects_empty_credentials():
    with pytest.raises(ValueError):
        BasicAuth(username="", password="p")
    with pytest.raises(ValueError):
        BasicAuth(username="u", password="")


def test_build_signed_saml_assertion_structure():
    pem = _make_private_key_pem()
    b64 = build_signed_saml_assertion(
        client_id="API_KEY_X",
        technical_user_id="sfadmin",
        token_url="https://api15.sapsf.cn/oauth/token",
        private_key_pem=pem,
    )
    xml = base64.b64decode(b64).decode()
    # Core bits a SAP token endpoint will verify
    assert "<saml2:Assertion" in xml
    assert "API_KEY_X" in xml
    assert "sfadmin" in xml
    root = ElementTree.fromstring(xml)
    audiences = [
        element.text for element in root.iter()
        if element.tag.rsplit("}", 1)[-1] == "Audience"
    ]
    assert audiences == ["www.successfactors.com"]
    assert "Signature" in xml  # xmldsig
    assert "SHA256" in xml.upper() or "sha256" in xml


def test_build_auth_from_config_basic():
    auth = build_auth_from_config({
        "auth_method": "basic",
        "username": "u@co",
        "password": "p",
    })
    assert isinstance(auth, BasicAuth)


def test_build_auth_from_config_oauth():
    pem = _make_private_key_pem()
    auth = build_auth_from_config({
        "auth_method": "oauth2_saml",
        "token_url": "https://x/oauth/token",
        "company_id": "MYCO",
        "api_key": "K",
        "technical_user_id": "u",
        "private_key": pem,
    })
    assert isinstance(auth, OAuth2SamlBearerAuth)
    assert auth.token_url == "https://x/oauth/token"
    assert auth.api_key == "K"


def test_build_auth_from_config_missing_field_raises():
    with pytest.raises(ValueError, match="missing fields"):
        build_auth_from_config({
            "auth_method": "oauth2_saml",
            "token_url": "https://x/oauth/token",
            # missing api_key, technical_user_id, private_key
            "company_id": "MYCO",
        })


def test_build_auth_from_config_unknown_method_raises():
    with pytest.raises(ValueError, match="Unknown SuccessFactors auth_method"):
        build_auth_from_config({"auth_method": "saml2_ecp", "base_url": "x"})


@pytest.mark.asyncio
async def test_oauth_access_token_cached_and_applied():
    pem = _make_private_key_pem()
    auth = OAuth2SamlBearerAuth(
        token_url="https://api15.sapsf.cn/oauth/token",
        company_id="MYCO",
        api_key="API_KEY",
        technical_user_id="sfadmin",
        private_key_pem=pem,
    )

    async with respx.mock(assert_all_called=False) as mock:
        token_route = mock.post("https://api15.sapsf.cn/oauth/token").mock(
            return_value=httpx.Response(
                200,
                json={"access_token": "TOKEN_123", "expires_in": 3600},
            )
        )
        req1 = httpx.Request("GET", "https://api15.sapsf.cn/odata/v2/FOCompany")
        await auth.apply(req1)
        assert req1.headers["Authorization"] == "Bearer TOKEN_123"

        # Second call reuses cached token — token endpoint not re-hit
        req2 = httpx.Request("GET", "https://api15.sapsf.cn/odata/v2/User")
        await auth.apply(req2)
        assert req2.headers["Authorization"] == "Bearer TOKEN_123"
        assert token_route.call_count == 1


def test_build_auth_from_config_client_credentials():
    """The CN + DE SF D-environments use IAS client_credentials; verify
    the factory selects the right class and copies fields through."""
    auth = build_auth_from_config({
        "auth_method": "oauth2_client_credentials",
        "token_url": "https://tenant.accounts.sapcloud.cn/oauth2/token",
        "client_id": "00000000-0000-0000-0000-000000000001",
        "client_secret": "s3cret",
        "resource": "urn:sap:identity:application:provider:name:SF_TEST",
    })
    assert isinstance(auth, OAuth2ClientCredentialsAuth)
    assert auth.token_url.endswith("/oauth2/token")
    assert auth.client_id == "00000000-0000-0000-0000-000000000001"
    assert auth.resource == "urn:sap:identity:application:provider:name:SF_TEST"


def test_build_auth_from_config_client_credentials_missing_fields():
    with pytest.raises(ValueError, match="missing fields"):
        build_auth_from_config({
            "auth_method": "oauth2_client_credentials",
            "token_url": "https://x/oauth2/token",
            # missing client_id, client_secret
        })


@pytest.mark.asyncio
async def test_client_credentials_token_caching_and_header():
    """First request fetches a token, second request reuses it."""
    auth = OAuth2ClientCredentialsAuth(
        token_url="https://ias.example.cn/oauth2/token",
        client_id="cid",
        client_secret="csecret",
        resource="urn:sap:foo",
    )

    async with respx.mock(assert_all_called=False) as mock:
        token_route = mock.post("https://ias.example.cn/oauth2/token").mock(
            return_value=httpx.Response(
                200,
                json={"access_token": "IAS_TOKEN", "expires_in": 3600},
            )
        )
        req1 = httpx.Request("GET", "https://api15.sapsf.cn/odata/v2/FOCompany")
        await auth.apply(req1)
        assert req1.headers["Authorization"] == "Bearer IAS_TOKEN"

        req2 = httpx.Request("GET", "https://api15.sapsf.cn/odata/v2/User")
        await auth.apply(req2)
        assert req2.headers["Authorization"] == "Bearer IAS_TOKEN"
        assert token_route.call_count == 1

        # Verify the form body sent to IAS — the resource field is what
        # scopes the token to the right SF application provider; omitting
        # it would fail silently later with a 401 from the OData API.
        body = token_route.calls[0].request.content.decode()
        assert "grant_type=client_credentials" in body
        assert "client_id=cid" in body
        assert "resource=" in body


@pytest.mark.asyncio
async def test_client_credentials_missing_access_token_raises():
    """If IAS returns 200 but no access_token (misconfigured resource),
    raise — but DO NOT echo the response payload back into the error
    message (Round-44 hardening: SAP IAS error bodies routinely carry
    client_secret hints / one-time codes / assertion fragments)."""
    auth = OAuth2ClientCredentialsAuth(
        token_url="https://ias.example.cn/oauth2/token",
        client_id="cid",
        client_secret="csecret",
    )
    async with respx.mock(assert_all_called=False) as mock:
        mock.post("https://ias.example.cn/oauth2/token").mock(
            return_value=httpx.Response(
                200, json={"error": "resource_not_authorized"},
            )
        )
        req = httpx.Request("GET", "https://api15.sapsf.cn/odata/v2/User")
        with pytest.raises(RuntimeError, match="missing access_token") as exc_info:
            await auth.apply(req)
        # Assert the response body is suppressed — neither the error
        # code nor the response dict can be in the exception message.
        assert "resource_not_authorized" not in str(exc_info.value)


@pytest.mark.asyncio
async def test_oauth_access_token_http_error_propagates():
    """4xx/5xx from the SF token endpoint raises ``RuntimeError`` (was
    ``httpx.HTTPStatusError`` pre-Round-44). The body is suppressed —
    SAP error responses can echo back the assertion / client_secret
    hint, so we keep diagnostics to status code only."""
    pem = _make_private_key_pem()
    auth = OAuth2SamlBearerAuth(
        token_url="https://api15.sapsf.cn/oauth/token",
        company_id="MYCO",
        api_key="API_KEY",
        technical_user_id="sfadmin",
        private_key_pem=pem,
    )

    async with respx.mock(assert_all_called=False) as mock:
        mock.post("https://api15.sapsf.cn/oauth/token").mock(
            return_value=httpx.Response(
                401,
                json={"error": "invalid_client"},
            )
        )
        req = httpx.Request("GET", "https://api15.sapsf.cn/odata/v2/FOCompany")
        with pytest.raises(RuntimeError, match="401") as exc_info:
            await auth.apply(req)
        # Body content must not leak into the raised exception.
        assert "invalid_client" not in str(exc_info.value)