"""Tests for SSO manager."""

from unittest.mock import MagicMock, patch

import pytest

from ai_org.core.sso_manager import SSOManager


@pytest.fixture
def mock_sso():
    """Create an SSOManager with mocked clients."""
    with patch.object(SSOManager, "__init__", lambda self, **kw: None):
        manager = SSOManager.__new__(SSOManager)
        manager.aws = MagicMock()
        manager.aws.region = "us-east-1"
        manager.sso_client = MagicMock()
        manager.identity_client = MagicMock()
        manager.config = MagicMock()
        manager._sso_instance_arn = None
        manager._identity_store_id = None
        return manager


@pytest.mark.unit
class TestSSOManager:
    def test_discover_sso_instance(self, mock_sso):
        mock_sso.sso_client.list_instances.return_value = {
            "Instances": [
                {
                    "InstanceArn": "arn:aws:sso:::instance/ssoins-1234567890abcdef",
                    "IdentityStoreId": "d-1234567890",
                }
            ]
        }
        mock_sso._discover_sso_instance()
        assert mock_sso._sso_instance_arn == "arn:aws:sso:::instance/ssoins-1234567890abcdef"
        assert mock_sso._identity_store_id == "d-1234567890"

    def test_discover_sso_instance_no_instance(self, mock_sso):
        mock_sso.sso_client.list_instances.return_value = {"Instances": []}
        with pytest.raises(Exception, match="No SSO instance found"):
            mock_sso._discover_sso_instance()

    def test_sso_instance_arn_property(self, mock_sso):
        mock_sso._sso_instance_arn = "arn:aws:sso:::instance/test"
        assert mock_sso.sso_instance_arn == "arn:aws:sso:::instance/test"

    def test_identity_store_id_property(self, mock_sso):
        mock_sso._identity_store_id = "d-test"
        assert mock_sso.identity_store_id == "d-test"

    def test_sso_instance_arn_lazy_discovery(self, mock_sso):
        mock_sso.sso_client.list_instances.return_value = {
            "Instances": [
                {
                    "InstanceArn": "arn:aws:sso:::instance/discovered",
                    "IdentityStoreId": "d-discovered",
                }
            ]
        }
        # Property triggers discovery
        arn = mock_sso.sso_instance_arn
        assert arn == "arn:aws:sso:::instance/discovered"
        mock_sso.sso_client.list_instances.assert_called_once()

    def test_list_permission_sets(self, mock_sso):
        mock_sso._sso_instance_arn = "arn:aws:sso:::instance/test"
        paginator = MagicMock()
        paginator.paginate.return_value = [
            {
                "PermissionSets": [
                    "arn:aws:sso:::permissionSet/ssoins-123/ps-admin",
                    "arn:aws:sso:::permissionSet/ssoins-123/ps-readonly",
                ]
            }
        ]
        mock_sso.sso_client.get_paginator.return_value = paginator
        mock_sso.sso_client.describe_permission_set.side_effect = [
            {
                "PermissionSet": {
                    "Name": "AWSAdministratorAccess",
                    "PermissionSetArn": "arn:aws:sso:::permissionSet/ssoins-123/ps-admin",
                }
            },
            {
                "PermissionSet": {
                    "Name": "AWSReadOnlyAccess",
                    "PermissionSetArn": "arn:aws:sso:::permissionSet/ssoins-123/ps-readonly",
                }
            },
        ]
        result = mock_sso.list_permission_sets()
        assert len(result) == 2
        assert result[0]["name"] == "AWSAdministratorAccess"
