# Copyright 2020 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

import abc

from tempest.api.identity import base
from tempest.lib.common.utils import data_utils
from tempest.lib import exceptions

from keystone_tempest_plugin.tests.rbac.v3 import base as rbac_base


class IdentityV3RbacRoleTest(rbac_base.IdentityV3RbacBaseTests,
                             metaclass=abc.ABCMeta):

    @classmethod
    def setup_clients(cls):
        super(IdentityV3RbacRoleTest, cls).setup_clients()
        cls.persona = getattr(cls, 'os_%s' % cls.credentials[0])
        cls.client = cls.persona.roles_v3_client
        cls.admin_client = cls.os_system_admin
        cls.admin_roles_client = cls.admin_client.roles_v3_client

    @classmethod
    def resource_setup(cls):
        super(IdentityV3RbacRoleTest, cls).resource_setup()
        cls.own_domain = cls.persona.credentials.domain_id
        cls.domain_id = cls.admin_client.domains_client.create_domain(
            name=data_utils.rand_name('domain'))['domain']['id']
        cls.addClassResourceCleanup(
            cls.admin_client.domains_client.delete_domain,
            cls.domain_id)
        cls.addClassResourceCleanup(
            cls.admin_client.domains_client.update_domain,
            cls.domain_id,
            enabled=False)
        cls.member_role_id = cls.admin_client.roles_v3_client.list_roles(
            name='member')['roles'][0]['id']

    def role(self, domain_id=None):
        role = {}
        name = data_utils.rand_name('role')
        role['name'] = name
        if domain_id:
            role['domain_id'] = domain_id
        return role

    @abc.abstractmethod
    def test_identity_create_role(self):
        """Test identity:create_role policy.

        This test must check:
          * whether the persona can create a role
        """
        pass

    @abc.abstractmethod
    def test_identity_get_role(self):
        """Test identity:get_role policy.

        This test must check:
          * whether the persona can get a role
          * whether the persona can get a role that does not exist
        """
        pass

    @abc.abstractmethod
    def test_identity_list_roles(self):
        """Test identity:list_roles policy.

        This test must check:
          * whether the persona can list roles
        """
        pass

    @abc.abstractmethod
    def test_identity_update_role(self):
        """Test identity:update_role policy.

        This test must check:
          * whether the persona can update a role
          * whether the persona can update a role that does not exist
        """
        pass

    @abc.abstractmethod
    def test_identity_delete_role(self):
        """Test identity:delete_role policy.

        This test must check
          * whether the persona can delete a role
          * whether the persona can delete a role that does not exist
        """
        pass

    @abc.abstractmethod
    def test_identity_create_domain_role(self):
        """Test identity:create_domain_role policy.

        This test must check:
          * whether the persona can create a domain role in their own domain
          * whether the persona can create a domain role in another domain
        """
        pass

    @abc.abstractmethod
    def test_identity_get_domain_role(self):
        """Test identity:get_domain_role policy.

        This test must check:
          * whether the persona can get a domain role in their own domain
          * whether the persona can get a domain role in another domain
          * whether the persona can get a domain role that does not exist
        """
        pass

    @abc.abstractmethod
    def test_identity_list_domain_roles(self):
        """Test identity:list_domain_roles policy.

        This test must check:
          * whether the persona can list domain roles for their own domain
          * whether the persona can list domain roles for another domain
        """
        pass

    @abc.abstractmethod
    def test_identity_update_domain_role(self):
        """Test identity:update_domain_role policy.

        This test must check:
          * whether the persona can update a domain role for their own domain
          * whether the persona can update a domain role for another domain
          * whether the persona can update a domain role that does not exist
        """
        pass

    @abc.abstractmethod
    def test_identity_delete_domain_role(self):
        """Test identity:delete_domain_role policy.

        This test must check
          * whether the persona can delete a domain role for their own domain
          * whether the persona can delete a domain role for another domain
          * whether the persona can delete a domain role that does not exist
        """
        pass


class SystemAdminTests(IdentityV3RbacRoleTest, base.BaseIdentityTest):

    credentials = ['system_admin']

    def test_identity_create_role(self):
        # user can create role
        resp = self.do_request('create_role',
                               expected_status=201,
                               **self.role())
        self.addCleanup(self.admin_roles_client.delete_role,
                        resp['role']['id'])

    def test_identity_get_role(self):
        # user can get role
        role = self.admin_roles_client.create_role(**self.role())['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('show_role', role_id=role['id'])
        # user gets a 404 for nonexistent role
        self.do_request('show_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())

    def test_identity_list_roles(self):
        # user can list roles
        role = self.admin_roles_client.create_role(**self.role())['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('list_roles')

    def test_identity_update_role(self):
        # user can update role
        role = self.admin_roles_client.create_role(**self.role())['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('update_role',
                        role_id=role['id'],
                        description=data_utils.arbitrary_string())
        # user gets a 404 for nonexistent role
        self.do_request('update_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex(),
                        description=data_utils.arbitrary_string())

    def test_identity_delete_role(self):
        # user can delete role
        role = self.admin_roles_client.create_role(**self.role())['role']
        self.do_request('delete_role', expected_status=204, role_id=role['id'])
        # user gets a 404 for nonexistent role
        self.do_request('delete_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())

    def test_identity_create_domain_role(self):
        # user can create domain role
        resp = self.do_request('create_role',
                               expected_status=201,
                               **self.role(domain_id=self.domain_id))
        self.addCleanup(self.admin_roles_client.delete_role,
                        resp['role']['id'])

    def test_identity_get_domain_role(self):
        # user can get domain role
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.domain_id))['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('show_role', role_id=role['id'])
        # user gets a 404 for nonexistent domain role
        self.do_request('show_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())

    def test_identity_list_domain_roles(self):
        # user can list domain roles
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.domain_id))['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('list_roles', domain_id=self.domain_id)

    def test_identity_update_domain_role(self):
        # user can update domain role
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.domain_id))['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('update_role',
                        role_id=role['id'],
                        description=data_utils.arbitrary_string())
        # user gets a 404 for nonexistent domain role
        self.do_request('update_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex(),
                        description=data_utils.arbitrary_string())

    def test_identity_delete_domain_role(self):
        # user can delete role in other domain
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.domain_id))['role']
        self.do_request('delete_role', expected_status=204, role_id=role['id'])
        # user gets a 404 for nonexistent role
        self.do_request('delete_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())


class SystemMemberTests(SystemAdminTests):

    credentials = ['system_member', 'system_admin']

    def test_identity_create_role(self):
        # user cannot create role
        self.do_request('create_role',
                        expected_status=exceptions.Forbidden,
                        **self.role())

    def test_identity_update_role(self):
        # user cannot update role
        role = self.admin_roles_client.create_role(
            **self.role())['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('update_role', expected_status=exceptions.Forbidden,
                        role_id=role['id'],
                        description=data_utils.arbitrary_string())
        # user gets a 404 for nonexistent role
        self.do_request('update_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex(),
                        description=data_utils.arbitrary_string())

    def test_identity_delete_role(self):
        # user can delete role
        role = self.admin_roles_client.create_role(
            **self.role())['role']
        self.do_request('delete_role', expected_status=exceptions.Forbidden,
                        role_id=role['id'])
        # user gets a 404 for nonexistent domain role
        self.do_request('delete_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())

    def test_identity_create_domain_role(self):
        # user cannot create domain role
        self.do_request('create_role',
                        expected_status=exceptions.Forbidden,
                        **self.role(domain_id=self.domain_id))

    def test_identity_update_domain_role(self):
        # user cannot update domain role
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.domain_id))['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('update_role', expected_status=exceptions.Forbidden,
                        role_id=role['id'],
                        description=data_utils.arbitrary_string())
        # user gets a 404 for nonexistent domain role
        self.do_request('update_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex(),
                        description=data_utils.arbitrary_string())

    def test_identity_delete_domain_role(self):
        # user cannot delete domain role
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.domain_id))['role']
        self.do_request('delete_role', expected_status=exceptions.Forbidden,
                        role_id=role['id'])
        # user gets a 404 for nonexistent domain role
        self.do_request('delete_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())


class SystemReaderTests(SystemMemberTests):

    credentials = ['system_reader', 'system_admin']


class DomainAdminTests(SystemReaderTests):

    credentials = ['domain_admin', 'system_admin']

    def test_identity_get_domain_role(self):
        # user cannot get domain role in own domain
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.own_domain))['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('show_role', expected_status=exceptions.Forbidden,
                        role_id=role['id'])
        # user gets a 404 for nonexistent domain role
        self.do_request('show_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())

    def test_identity_list_domain_roles(self):
        # user cannot list domain roles in own domain
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.own_domain))['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('list_roles', expected_status=exceptions.Forbidden,
                        domain_id=self.persona.credentials.domain_id)
        # user cannot get domain role in other domain
        role = self.admin_roles_client.create_role(
            **self.role(domain_id=self.domain_id))['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('list_roles', expected_status=exceptions.Forbidden,
                        domain_id=self.domain_id)


class DomainManagerTests(DomainAdminTests):

    credentials = ['domain_manager', 'system_admin']

    def test_identity_get_role(self):
        # user can get role that is part of the domain_managed_target_role
        # list for domain managers, which per default includes "member"
        self.do_request('show_role', role_id=self.member_role_id)
        # user cannot get arbitrary global role not part of the
        # domain_managed_target_role list
        role = self.admin_roles_client.create_role(
            **self.role())['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('show_role', expected_status=exceptions.Forbidden,
                        role_id=role['id'])
        # user gets a 404 for nonexistent role
        self.do_request('show_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())


class DomainMemberTests(DomainManagerTests):

    credentials = ['domain_member', 'system_admin']

    def test_identity_get_role(self):
        # user cannot get role
        role = self.admin_roles_client.create_role(
            **self.role())['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('show_role', expected_status=exceptions.Forbidden,
                        role_id=role['id'])
        # user gets a 404 for nonexistent role
        self.do_request('show_role', expected_status=exceptions.NotFound,
                        role_id=data_utils.rand_uuid_hex())

    def test_identity_list_roles(self):
        # user cannot list roles
        role = self.admin_roles_client.create_role(**self.role())['role']
        self.addCleanup(self.admin_roles_client.delete_role, role['id'])
        self.do_request('list_roles', expected_status=exceptions.Forbidden)


class DomainReaderTests(DomainMemberTests):

    credentials = ['domain_reader', 'system_admin']


class ProjectAdminTests(SystemAdminTests):

    credentials = ['project_admin', 'system_admin']


class ProjectManagerTests(DomainMemberTests):

    credentials = ['project_manager', 'system_admin']


class ProjectMemberTests(ProjectManagerTests):

    credentials = ['project_member', 'system_admin']


class ProjectReaderTests(ProjectMemberTests):

    credentials = ['project_reader', 'system_admin']
