import http
import json

import pytest

from h2o_secure_store.exception import CustomApiException


def test_create_oauth_client(
    delete_all_oauth_clients_before_after,
    super_admin_oauth_client_client,
):
    oauth_client = super_admin_oauth_client_client.create_oauth_client(
        issuer="issuer1",
        client_id="client1",
        oauth_client_id="oauth-client1",
        authorization_endpoint="authz-endpoint",
        token_endpoint="token-endpoint",
    )

    assert oauth_client.issuer == "issuer1"
    assert oauth_client.client_id == "client1"
    assert oauth_client.name == "oauthClients/oauth-client1"
    assert oauth_client.display_name == ""
    assert oauth_client.client_secret == ""
    assert oauth_client.client_secret_set is False
    assert oauth_client.authorization_endpoint == "authz-endpoint"
    assert oauth_client.token_endpoint == "token-endpoint"
    assert oauth_client.extra_scopes == []
    assert oauth_client.refresh_disabled is False
    assert oauth_client.login_principal_claim == "preferred_username"
    assert oauth_client.callback_uri != ""
    assert oauth_client.creator != ""
    assert oauth_client.updater == ""
    assert oauth_client.create_time is not None
    assert oauth_client.update_time is None
    assert oauth_client.uid != ""


def test_create_oauth_client_already_exists(
    delete_all_oauth_clients_before_after,
    super_admin_oauth_client_client,
):
    super_admin_oauth_client_client.create_oauth_client(
        issuer="issuer1",
        client_id="client1",
        oauth_client_id="oauth-client1",
        authorization_endpoint="authz-endpoint",
        token_endpoint="token-endpoint",
    )

    with pytest.raises(CustomApiException) as exc:
        super_admin_oauth_client_client.create_oauth_client(
            issuer="issuer1",
            client_id="client1",
            oauth_client_id="oauth-client1",
            authorization_endpoint="authz-endpoint",
            token_endpoint="token-endpoint",
        )

    # grpc AlreadyExists == http Conflict 409
    assert exc.value.status == http.HTTPStatus.CONFLICT


def test_create_oauth_client_autogenerated_id(
    delete_all_oauth_clients_before_after,
    super_admin_oauth_client_client,
):
    oauth_client = super_admin_oauth_client_client.create_oauth_client(
        issuer="issuer1",
        client_id="client1",
        authorization_endpoint="authz-endpoint",
        token_endpoint="token-endpoint",
    )
    assert oauth_client.oauth_client_id != ""


def test_create_oauth_default_endpoints(
    delete_all_oauth_clients_before_after,
    super_admin_oauth_client_client,
):
    # authorization_endpoint and token_endpoint are set by server by discovering the endpoints from the issuer.
    # Using dev-okta for that.
    oauth_client = super_admin_oauth_client_client.create_oauth_client(
        issuer="http://keycloak:9080/realms/hac-dev",
        client_id="test-client",
        client_secret="test-secret",
    )

    assert oauth_client.issuer == "http://keycloak:9080/realms/hac-dev"
    assert oauth_client.client_id == "test-client"
    assert oauth_client.client_secret == ""
    assert oauth_client.client_secret_set is True
    assert oauth_client.authorization_endpoint == 'http://keycloak:9080/realms/hac-dev/protocol/openid-connect/auth'
    assert oauth_client.token_endpoint == 'http://keycloak:9080/realms/hac-dev/protocol/openid-connect/token'


def test_create_oauth_client_validation(
    delete_all_oauth_clients_before_after,
    super_admin_oauth_client_client,
):

    with pytest.raises(CustomApiException) as exc:
        super_admin_oauth_client_client.create_oauth_client(
            issuer="issuer1",
            client_id="client1",
            oauth_client_id="oauth-client1",
            authorization_endpoint="authz-endpoint",
            token_endpoint="token-endpoint",
            extra_scopes=["openid"]
        )
    assert exc.value.status == http.HTTPStatus.BAD_REQUEST
    assert 'extraScope "openid" is forbidden' in json.loads(exc.value.body)["message"]


