import pytest
from rancher import ApiError
from .common import *  # NOQA

namespace = {"p_client": None, "ns": None, "cluster": None, "project": None}


def test_create_hpa():
    p_client = namespace["p_client"]
    ns = namespace["ns"]
    hpa, workload = create_hpa(p_client, ns)
    p_client.delete(hpa, workload)


def test_edit_hpa():
    p_client = namespace["p_client"]
    ns = namespace["ns"]
    hpa, workload = edit_hpa(p_client, ns)
    p_client.delete(hpa, workload)


def test_delete_hpa():
    p_client = namespace["p_client"]
    ns = namespace["ns"]
    hpa, workload = create_hpa(p_client, ns)
    delete_hpa(p_client, hpa, ns)
    p_client.delete(workload)


rbac_role_list = [
    (CLUSTER_OWNER),
    (PROJECT_OWNER),
    (PROJECT_MEMBER),
    (PROJECT_READ_ONLY),
    (CLUSTER_MEMBER),
]


@if_test_rbac
@pytest.mark.parametrize("role", rbac_role_list)
def test_rbac_hpa_create(role, remove_resource):
    user_project = None
    if(role == CLUSTER_MEMBER):
        user_token = rbac_get_user_token_by_role(CLUSTER_MEMBER)
        user_project, ns = create_project_and_ns(user_token,
                                                 namespace["cluster"],
                                                 random_test_name(
                                                     "cluster-mem"))
        p_client = get_project_client_for_token(user_project, user_token)
    else:
        user_token = rbac_get_user_token_by_role(role)
        project = rbac_get_project()
        ns = rbac_get_namespace()
        p_client = get_project_client_for_token(project, user_token)

    if (role != PROJECT_READ_ONLY):
        newhpa, newworkload = create_hpa(p_client, ns)
        remove_resource(newhpa)
        remove_resource(newworkload)
    else:
        project = rbac_get_project()
        ns = rbac_get_namespace()
        user_token = rbac_get_user_token_by_role(PROJECT_READ_ONLY)
        readonly_user_client = get_project_client_for_token(project,
                                                            user_token)
        # Verify Read Only member cannot create hpa objects
        with pytest.raises(ApiError) as e:
            create_hpa(readonly_user_client, ns)
        assert e.value.error.status == 403
        assert e.value.error.code == 'Forbidden'
    if(user_project is not None):
        remove_resource(user_project)


@if_test_rbac
@pytest.mark.parametrize("role", rbac_role_list)
def test_rbac_hpa_create_negative(role, remove_resource):
    if (role == CLUSTER_OWNER):
        print(role)
        unshared_project = rbac_get_unshared_project()
        ns = rbac_get_unshared_ns()
        user_token = rbac_get_user_token_by_role(role)
        p_client = get_project_client_for_token(unshared_project, user_token)
        hpa, workload = create_hpa(p_client, ns)
        remove_resource(hpa)
        remove_resource(workload)
    else:
        unshared_project = rbac_get_unshared_project()
        ns = rbac_get_unshared_ns()
        cluster_owner_token = rbac_get_user_token_by_role(CLUSTER_OWNER)
        owner_client = get_project_client_for_token(unshared_project,
                                                    cluster_owner_token)
        # Workload created by cluster owner in unshared project is passed as
        # parameter to create HPA
        workload = create_workload(owner_client, ns)
        user_token = rbac_get_user_token_by_role(role)
        p_client = get_project_client_for_token(unshared_project, user_token)
        with pytest.raises(ApiError) as e:
            create_hpa(p_client, ns, workload=workload)