from .user import parse_cloudtrail_user


def test_parse_cloudtrail_user_prefers_one_canonical_identity():
    cloudtrail_event = {
        "userIdentity": {
            "arn": "arn:aws:sts::123:assumed-role/demo/session",
            "principalId": "ABCD:session",
            "sessionContext": {
                "sessionIssuer": {
                    "arn": "arn:aws:iam::123:role/demo",
                    "userName": "demo-role",
                }
            },
            "userName": "demo-user",
        }
    }

    assert parse_cloudtrail_user(cloudtrail_event) == {
        "user_email": None,
        "user_id": "ABCD:session",
        "user_name": "ABCD:session",
    }


def test_parse_cloudtrail_user_supports_on_behalf_of():
    cloudtrail_event = {
        "userIdentity": {
            "onBehalfOf": {"userId": "federated-user"},
            "arn": "arn:aws:sts::123:assumed-role/demo/session",
        }
    }

    assert parse_cloudtrail_user(cloudtrail_event) == {
        "user_email": None,
        "user_id": "federated-user",
        "user_name": "federated-user",
    }


def test_parse_cloudtrail_user_prefers_human_email_from_principal_suffix():
    cloudtrail_event = {
        "userIdentity": {
            "principalId": "AROATESTPRINCIPAL:alice.analyst@example.com",
            "userName": "team-role",
            "sessionContext": {
                "sessionIssuer": {
                    "userName": "team-role",
                }
            },
        }
    }

    assert parse_cloudtrail_user(cloudtrail_event) == {
        "user_email": "alice.analyst@example.com",
        "user_id": "alice.analyst@example.com",
        "user_name": "alice.analyst@example.com",
    }


def test_parse_cloudtrail_user_normalizes_technical_session_suffix():
    cloudtrail_event = {
        "userIdentity": {
            "principalId": "AROATECHNICAL:batch-import-job-1774287028612",
            "userName": "etl-role",
        }
    }

    assert parse_cloudtrail_user(cloudtrail_event) == {
        "user_email": None,
        "user_id": "batch-import-job",
        "user_name": "batch-import-job",
    }


def test_parse_cloudtrail_user_uses_role_name_for_generic_sdk_sessions():
    cloudtrail_event = {
        "userIdentity": {
            "principalId": "AROAGENERIC:botocore-session-1773536400000550554",
            "sessionContext": {
                "sessionIssuer": {
                    "userName": "team-role",
                }
            },
        }
    }

    assert parse_cloudtrail_user(cloudtrail_event) == {
        "user_email": None,
        "user_id": "team-role",
        "user_name": "team-role",
    }


def test_parse_cloudtrail_user_keeps_principal_id_for_generic_sdk_sessions_without_role():
    cloudtrail_event = {
        "userIdentity": {
            "principalId": "AROAGENERIC:botocore-session-1773536400000550554",
        }
    }

    assert parse_cloudtrail_user(cloudtrail_event) == {
        "user_email": None,
        "user_id": "AROAGENERIC:botocore-session-1773536400000550554",
        "user_name": "AROAGENERIC:botocore-session-1773536400000550554",
    }
