def test_service_accounts(session, standard_graph, users, http_client, base_url):  # noqa: F811
    api_url = url(base_url, "/service_accounts")
    resp = yield http_client.fetch(api_url)
    body = json.loads(resp.body)
    assert resp.code == 200
    assert body["status"] == "ok"
    assert sorted(body["data"]["service_accounts"]) == sorted(
        [u.name for u in itervalues(users) if u.role_user] + ["[email protected]"]
    )

    # Retrieve a single service account and check its metadata.
    api_url = url(base_url, "/service_accounts/[email protected]")
    resp = yield http_client.fetch(api_url)
    body = json.loads(resp.body)
    assert resp.code == 200
    assert body["status"] == "ok"
    data = body["data"]["user"]
    assert "service_account" in data
    assert data["service_account"]["description"] == "some service account"
    assert data["service_account"]["machine_set"] == "some machines"
    assert data["service_account"]["owner"] == "team-sre"
    assert body["data"]["permissions"] == []

    # Delegate a permission to the service account and check for it.
    service_account = ServiceAccount.get(session, name="[email protected]")
    permission = get_permission(session, "team-sre")
    grant_permission_to_service_account(session, service_account, permission, "*")
    standard_graph.update_from_db(session)
    resp = yield http_client.fetch(api_url)
    body = json.loads(resp.body)
    assert resp.code == 200
    assert body["status"] == "ok"
    perms = body["data"]["permissions"]
    assert perms[0]["permission"] == "team-sre"
    assert perms[0]["argument"] == "*"

def test_list_pagination(tmpdir, setup, browser):
    # type: (LocalPath, SetupTest, Chrome) -> None
    """Test pagination.

    This forces the pagination to specific values, rather than using the page controls, since we
    don't create more than 100 permissions for testing.
    """
    permissions = create_test_data(setup)
    settings = FrontendSettings()
    settings.update_from_config(src_path("config", "dev.yaml"))
    expected_permissions = [
        (p.name, p.description, format_date(settings, p.created_on)) for p in permissions
    ]

    with frontend_server(tmpdir, "[email protected]") as frontend_url:
        browser.get(url(frontend_url, "/permissions?limit=1&offset=1"))
        page = PermissionsPage(browser)
        seen_permissions = [(r.name, r.description, r.created_on) for r in page.permission_rows]
        assert seen_permissions == sorted(expected_permissions)[1:2]
        assert page.limit_label == "Limit: 1"

        # Retrieve the last permission but with a larger limit to test that the limit isn't capped
        # to the number of returned items.
        browser.get(url(frontend_url, "/permissions?limit=10&offset=2"))
        page = PermissionsPage(browser)
        seen_permissions = [(r.name, r.description, r.created_on) for r in page.permission_rows]
        assert seen_permissions == sorted(expected_permissions)[2:]
        assert page.limit_label == "Limit: 10"

def test_remove_last_owner_via_audit(async_server, browser, users, groups, session):  # noqa: F811
    future = datetime.utcnow() + timedelta(1)

    add_member(groups["auditors"], users["[email protected]"], role="owner")
    add_member(groups["audited-team"], users["[email protected]"], role="owner", expiration=future)

    session.commit()

    fe_url = url(async_server, "/audits/create")
    browser.get(fe_url)

    page = AuditsCreatePage(browser)

    page.set_end_date(future.strftime("%m/%d/%Y"))
    page.submit()

    fe_url = url(async_server, "/groups/audited-team")
    browser.get(fe_url)

    page = GroupViewPage(browser)

    audit_modal = page.get_audit_modal()
    audit_modal.find_member_row("[email protected]").set_audit_status("remove")
    audit_modal.confirm()

    assert page.current_url.endswith("/groups/audited-team")
    assert page.has_text(group_ownership_policy.EXCEPTION_MESSAGE)

def test_require_clickthru(tmpdir, setup, browser):
    # type: (LocalPath, SetupTest, Chrome) -> None
    with frontend_server(tmpdir, "[email protected]") as frontend_url:
        browser.get(url(frontend_url, "/groups"))
        groups_page = GroupsViewPage(browser)

        groups_page.click_create_group_button()
        create_group_modal = groups_page.get_create_group_modal()
        create_group_modal.set_group_name("test-group")
        create_group_modal.set_join_policy(GroupJoinPolicy.CAN_JOIN)
        create_group_modal.click_require_clickthru_checkbox()
        create_group_modal.confirm()

    with frontend_server(tmpdir, "[email protected]") as frontend_url:
        browser.get(url(frontend_url, "/groups/test-group/join"))
        join_page = GroupJoinPage(browser)

        join_page.set_reason("Testing")
        join_page.submit()
        clickthru_modal = join_page.get_clickthru_modal()
        clickthru_modal.confirm()

        group_page = GroupViewPage(browser)
        assert group_page.current_url.endswith("/groups/test-group?refresh=yes")
        assert group_page.find_member_row("[email protected]")

def test_public_key(session, users, http_client, base_url):  # noqa: F811
    user = users["[email protected]"]
    assert not get_public_keys_of_user(session, user.id)

    # add it
    fe_url = url(base_url, "/users/{}/public-key/add".format(user.username))
    resp = yield http_client.fetch(
        fe_url,
        method="POST",
        body=urlencode({"public_key": SSH_KEY_ED25519}),
        headers={"X-Grouper-User": user.username},
    )
    assert resp.code == 200

    user = User.get(session, name=user.username)
    keys = get_public_keys_of_user(session, user.id)
    assert len(keys) == 1
    assert keys[0].public_key == SSH_KEY_ED25519
    assert keys[0].fingerprint == "fa:d9:ca:40:bd:f7:64:37:a7:99:3a:8e:50:8a:c5:94"
    assert keys[0].fingerprint_sha256 == "ExrCZ0nqSJv+LqAEh8CWeKUxiAeZA+N0bKC18dK7Adg"
    assert keys[0].comment == "comment"

    # delete it
    fe_url = url(base_url, "/users/{}/public-key/{}/delete".format(user.username, keys[0].id))
    resp = yield http_client.fetch(
        fe_url, method="POST", body="", headers={"X-Grouper-User": user.username}
    )
    assert resp.code == 200

    user = User.get(session, name=user.username)
    assert not get_public_keys_of_user(session, user.id)

def test_toggle_perm_audited(groups, permissions, http_client, base_url):  # noqa: F811
    perm_name = "audited"  # perm that is already audited
    nonpriv_user_name = "[email protected]"  # user with no audit perms and without PERMISSION_ADMIN
    nonpriv_user_team = "sad-team"
    nonpriv_headers = {"X-Grouper-User": nonpriv_user_name}
    priv_user_name = "[email protected]"  # user with AUDIT_MANAGER
    priv_headers = {"X-Grouper-User": priv_user_name}
    enable_url = url(base_url, "/permissions/{}/enable-auditing".format(perm_name))
    disable_url = url(base_url, "/permissions/{}/disable-auditing".format(perm_name))

    # Give nonpriv user audit view permissions, which shouldn't allow enabling/disabling auditing
    grant_permission(groups[nonpriv_user_team], permissions[AUDIT_VIEWER], argument="")

    # attempt to enable/disable auditing; both should fail due to lack of perms
    with pytest.raises(HTTPError):
        resp = yield http_client.fetch(enable_url, method="POST", headers=nonpriv_headers, body="")
    with pytest.raises(HTTPError):
        resp = yield http_client.fetch(
            disable_url, method="POST", headers=nonpriv_headers, body=""
        )

    # Now confirm that enabling/disabling auditing works as a privileged user
    # Note that enabling audits on an audited perm succeeds (same for disabling)
    resp = yield http_client.fetch(enable_url, method="POST", headers=priv_headers, body="")
    assert resp.code == 200
    # Perm is still audited
    resp = yield http_client.fetch(disable_url, method="POST", headers=priv_headers, body="")
    assert resp.code == 200
    # Perm no longer audited
    resp = yield http_client.fetch(disable_url, method="POST", headers=priv_headers, body="")
    assert resp.code == 200
    # Perm still not audited
    resp = yield http_client.fetch(enable_url, method="POST", headers=priv_headers, body="")
    assert resp.code == 200

def test_group_request(session, users, groups, http_client, base_url):  # noqa: F811
    user = users["[email protected]"]
    group = groups["sad-team"]

    # Request to join

    fe_url = url(base_url, "/groups/{}/join".format(group.groupname))
    resp = yield http_client.fetch(
        fe_url,
        method="POST",
        headers={"X-Grouper-User": user.username},
        body=urlencode({"reason": "Test Request", "member": "User: [email protected]"}),
    )
    assert resp.code == 200

    request = Request.get(session, requester_id=user.id, requesting_id=group.id)
    assert request.status == "pending"

    # Approve request

    fe_url = url(base_url, "/groups/{}/requests/{}".format(group.groupname, request.id))
    resp = yield http_client.fetch(
        fe_url,
        method="POST",
        headers={"X-Grouper-User": "[email protected]"},
        body=urlencode({"reason": "Test Request", "status": "actioned"}),
    )
    assert resp.code == 200

    request = Request.get(session, requester_id=user.id, requesting_id=group.id)
    assert request.status == "actioned"

def test_service_account_lifecycle(async_server, browser):  # noqa: F811
    browser.get(url(async_server, "/groups/user-admins"))

    page = GroupViewPage(browser)
    page.click_add_service_account_button()

    page = ServiceAccountCreatePage(browser)
    page.set_name("my-special-service-account")
    page.submit()

    page = ServiceAccountViewPage(browser)
    page.click_disable_button()

    disable_modal = page.get_disable_modal()
    disable_modal.confirm()

    browser.get(url(async_server, "/users"))

    page = UsersViewPage(browser)
    page.click_show_disabled_users_button()
    page.click_show_service_accounts_button()

    user_row = page.find_user_row("[email protected] (service)")
    user_row.click()

    page = ServiceAccountViewPage(browser)
    page.click_enable_button()

    page = ServiceAccountEnablePage(browser)
    page.select_owner("Group: user-admins")
    page.submit()

def test_user_tok_acls(
    session, graph, users, user_admin_perm_to_auditors, http_client, base_url  # noqa: F811
):
    role_user = "[email protected]"
    admin = "[email protected]"
    pleb = "[email protected]"

    # admin creating token for role user
    fe_url = url(base_url, "/users/{}/tokens/add".format(role_user))
    resp = yield http_client.fetch(
        fe_url, method="POST", headers={"X-Grouper-User": admin}, body=urlencode({"name": "foo"})
    )
    assert resp.code == 200

    with pytest.raises(HTTPError):
        # non-admin creating token for role user
        resp = yield http_client.fetch(
            fe_url,
            method="POST",
            headers={"X-Grouper-User": pleb},
            body=urlencode({"name": "foo2"}),
        )

    fe_url = url(base_url, "/users/{}/tokens/add".format(pleb))
    with pytest.raises(HTTPError):
        # admin creating token for normal (non-role) user
        resp = yield http_client.fetch(
            fe_url,
            method="POST",
            headers={"X-Grouper-User": admin},
            body=urlencode({"name": "foo3"}),
        )

def test_shell(session, users, http_client, base_url, graph):  # noqa: F811
    user = users["[email protected]"]
    assert not get_user_metadata_by_key(session, user.id, USER_METADATA_SHELL_KEY)

    set_user_metadata(session, user.id, USER_METADATA_SHELL_KEY, "/bin/bash")
    graph.update_from_db(session)

    fe_url = url(base_url, "/users/{}".format(user.username))
    resp = yield http_client.fetch(fe_url)
    assert resp.code == 200
    body = json.loads(resp.body)
    assert body["data"]["user"]["metadata"] != [], "There should be metadata"
    assert len(body["data"]["user"]["metadata"]) == 1, "There should only be 1 metadata!"
    assert (
        body["data"]["user"]["metadata"][0]["data_key"] == "shell"
    ), "There should only be 1 metadata!"
    assert (
        body["data"]["user"]["metadata"][0]["data_value"] == "/bin/bash"
    ), "The shell should be set to the correct value"

    set_user_metadata(session, user.id, USER_METADATA_SHELL_KEY, "/bin/zsh")
    graph.update_from_db(session)

    fe_url = url(base_url, "/users/{}".format(user.username))
    resp = yield http_client.fetch(fe_url)
    assert resp.code == 200
    body = json.loads(resp.body)
    assert body["data"]["user"]["metadata"] != [], "There should be metadata"
    assert (
        body["data"]["user"]["metadata"][0]["data_key"] == "shell"
    ), "There should only be 1 metadata!"
    assert (
        body["data"]["user"]["metadata"][0]["data_value"] == "/bin/zsh"
    ), "The shell should be set to the correct value"
    assert len(body["data"]["user"]["metadata"]) == 1, "There should only be 1 metadata!"

def test_public_key_admin(session, users, http_client, base_url):  # noqa: F811
    user = users["[email protected]"]
    assert not get_public_keys_of_user(session, user.id)

    # add it
    fe_url = url(base_url, "/users/{}/public-key/add".format(user.username))
    resp = yield http_client.fetch(
        fe_url,
        method="POST",
        body=urlencode({"public_key": SSH_KEY_1}),
        headers={"X-Grouper-User": user.username},
    )
    assert resp.code == 200

    user = User.get(session, name=user.username)
    keys = get_public_keys_of_user(session, user.id)
    assert len(keys) == 1
    assert keys[0].public_key == SSH_KEY_1

    # have an admin delete it
    fe_url = url(base_url, "/users/{}/public-key/{}/delete".format(user.username, keys[0].id))
    resp = yield http_client.fetch(
        fe_url, method="POST", body="", headers={"X-Grouper-User": "[email protected]"}
    )
    assert resp.code == 200

    user = User.get(session, name=user.username)
    assert not get_public_keys_of_user(session, user.id)

def test_list_create_button(tmpdir, setup, browser):
    # type: (LocalPath, SetupTest, Chrome) -> None
    with frontend_server(tmpdir, "[email protected]") as frontend_url:
        browser.get(url(frontend_url, "/permissions"))
        page = PermissionsPage(browser)
        assert not page.has_create_permission_button

        with setup.transaction():
            setup.grant_permission_to_group(PERMISSION_CREATE, "*", "admins")
            setup.add_user_to_group("[email protected]", "admins")
        browser.get(url(frontend_url, "/permissions?refresh=yes"))
        assert page.has_create_permission_button

def test_user_enable_disable(
    session,  # noqa: F811
    graph,  # noqa: F811
    users,  # noqa: F811
    user_admin_perm_to_auditors,
    user_enable_perm_to_sre,
    http_client,
    base_url,
):
    username = u"[email protected]"
    old_groups = sorted(get_groups(graph, username))
    headers_admin = {"X-Grouper-User": "[email protected]"}
    headers_enable = {"X-Grouper-User": "[email protected]"}
    body_preserve = urlencode({"preserve_membership": "true"})
    body_base = urlencode({})

    # disable user
    fe_url = url(base_url, "/users/{}/disable".format(username))
    resp = yield http_client.fetch(fe_url, method="POST", headers=headers_admin, body=body_base)
    assert resp.code == 200

    # Attempt to enable user, preserving groups, as user with `grouper.user.enable`.
    # Should fail due to lack of admin perm.
    fe_url = url(base_url, "/users/{}/enable".format(username))
    with pytest.raises(HTTPError):
        resp = yield http_client.fetch(
            fe_url, method="POST", headers=headers_enable, body=body_preserve
        )

    # enable user, PRESERVE groups, as a user with the correct admin permission
    fe_url = url(base_url, "/users/{}/enable".format(username))
    resp = yield http_client.fetch(
        fe_url, method="POST", headers=headers_admin, body=body_preserve
    )
    assert resp.code == 200
    graph.update_from_db(session)
    assert old_groups == sorted(get_groups(graph, username)), "nothing should be removed"

    # disable user again
    fe_url = url(base_url, "/users/{}/disable".format(username))
    resp = yield http_client.fetch(fe_url, method="POST", headers=headers_admin, body=body_base)
    assert resp.code == 200

    # Attempt to enable user, PURGE groups. Should now succeed even with
    # only the `grouper.user.enable` perm.
    fe_url = url(base_url, "/users/{}/enable".format(username))
    resp = yield http_client.fetch(fe_url, method="POST", headers=headers_enable, body=body_base)
    assert resp.code == 200

    graph.update_from_db(session)
    assert len(get_groups(graph, username)) == 0, "all group membership should be removed"

def test_permissions(permissions, http_client, base_url, session, graph):  # noqa: F811
    api_url = url(base_url, "/permissions")
    resp = yield http_client.fetch(api_url)
    body = json.loads(resp.body)

    assert resp.code == 200
    assert body["status"] == "ok"
    assert sorted(body["data"]["permissions"]) == sorted(permissions)

    api_url = url(base_url, "/permissions/{}".format("team-sre"))
    resp = yield http_client.fetch(api_url)
    body = json.loads(resp.body)

    assert resp.code == 200
    assert body["status"] == "ok"

def test_view_change_audited(tmpdir, setup, browser):
    # type: (LocalPath, SetupTest, Chrome) -> None
    with setup.transaction():
        setup.add_user_to_group("[email protected]", "audit-managers")
        setup.grant_permission_to_group(AUDIT_MANAGER, "", "audit-managers")
        setup.create_permission("some-permission", "Some permission")

    with frontend_server(tmpdir, "[email protected]") as frontend_url:
        browser.get(url(frontend_url, "/permissions/some-permission"))
        page = PermissionViewPage(browser)
        assert not page.has_disable_permission_button
        assert not page.has_audited_warning
        assert page.has_enable_auditing_button

        page.click_enable_auditing_button()
        enable_auditing_modal = page.get_enable_auditing_modal()
        enable_auditing_modal.confirm()

        assert page.subheading == "some-permission"
        assert page.has_audited_warning
        assert not page.has_enable_auditing_button
        assert page.has_disable_auditing_button

        page.click_disable_auditing_button()
        disable_auditing_modal = page.get_disable_auditing_modal()
        disable_auditing_modal.confirm()

        assert page.subheading == "some-permission"
        assert not page.has_audited_warning
        assert page.has_enable_auditing_button
        assert not page.has_disable_auditing_button

def test_permission_grant_revoke(tmpdir, setup, browser):
    # type: (LocalPath, SetupTest, Chrome) -> None
    with setup.transaction():
        setup.add_user_to_group("[email protected]", "some-group")
        setup.grant_permission_to_group("some-permission", "foo", "some-group")
        setup.create_service_account("[email protected]", "some-group")

    with frontend_server(tmpdir, "[email protected]") as frontend_url:
        browser.get(url(frontend_url, "/groups/some-group/service/[email protected]"))

        page = ServiceAccountViewPage(browser)
        assert page.permission_rows == []
        page.click_add_permission_button()

        grant_page = ServiceAccountGrantPermissionPage(browser)
        grant_page.select_permission("some-permission (foo)")
        grant_page.set_argument("foo")
        grant_page.submit()

        page = ServiceAccountViewPage(browser)
        permission_rows = page.permission_rows
        assert len(permission_rows) == 1
        permission = permission_rows[0]
        assert permission.permission == "some-permission"
        assert permission.argument == "foo"

        permission.click_revoke_button()
        permission_revoke_modal = page.get_revoke_permission_modal()
        permission_revoke_modal.confirm()

        assert page.permission_rows == []

def test_limited_permissions_global_approvers(
    session, standard_graph, groups, grantable_permissions, http_client, base_url  # noqa: F811
):
    """Test that notifications are not sent to global approvers."""
    perm_grant, _, perm1, _ = grantable_permissions
    grant_permission(groups["security-team"], perm_grant, argument="grantable.*")

    # SPECIFIC REQUEST: 'grantable.one', 'specific_arg' for 'sad-team'
    groupname = "sad-team"
    username = "[email protected]"
    fe_url = url(base_url, "/groups/{}/permission/request".format(groupname))
    resp = yield http_client.fetch(
        fe_url,
        method="POST",
        body=urlencode(
            {
                "permission_name": perm1.name,
                "argument": "specific_arg",
                "reason": "blah blah black sheep",
                "argument_type": "text",
            }
        ),
        headers={"X-Grouper-User": username},
    )
    assert resp.code == 200

    emails = _get_unsent_and_mark_as_sent_emails(session)
    assert_same_recipients(emails, [u"[email protected]"])

def test_completed_inbound_requests(async_server, browser, do_action_requests):  # noqa: F811
    fe_url = url(async_server, "/permissions/requests?")
    browser.get(fe_url)

    # Check that the request rows have info we expect
    page = PermissionRequestsPage(browser)
    request_rows = page.request_rows
    expected_perms = [
        "{}, {}".format(PERM_WITH_GRANTER, ARGUMENT),
        "{}, {}".format(PERM_NO_GRANTER, ARGUMENT),
        "{}, {}".format(PERMISSION_ADMIN, ARGUMENT),
    ]
    request_perms = [row.requested for row in request_rows]
    assert sorted(expected_perms) == sorted(request_perms)

    # Check the status change rows as well.  The timestamp part of the row is normally "(now)" but
    # can be "(1 second ago)" on slow systems and "(in the future)" if MySQL rounds the timestamp
    # up.  Allow for all of these.
    expected_whos = ([REQUESTING_USER] * 3) + ([GRANTING_USER] * 2)
    request_whos = []
    for row in page.status_change_rows:
        who, when = row.who.split(None, 1)
        assert when in ("(now)", "(1 second ago)", "(in the future)")
        request_whos.append(who)
    assert sorted(expected_whos) == sorted(request_whos)

    # and make sure the "no requests" row doesn't show up
    with pytest.raises(Exception):
        page.no_requests_row

def test_invalid_user(tmpdir, setup, browser):
    # type: (LocalPath, SetupTest, Chrome) -> None
    with frontend_server(tmpdir, "[email protected]") as frontend_url:
        browser.get(url(frontend_url, "/"))
        page = ErrorPage(browser)
        assert page.heading == "Error"
        assert page.subheading == "403 Forbidden"
        assert "[email protected] does not match" in page.content

def test_users(users, http_client, base_url):  # noqa: F811
    all_users = sorted(list(users.keys()) + ["[email protected]"])
    users_wo_role = sorted([u for u in users if u != u"[email protected]"])

    api_url = url(base_url, "/users")
    resp = yield http_client.fetch(api_url)
    body = json.loads(resp.body)
    assert resp.code == 200
    assert body["status"] == "ok"
    assert sorted(body["data"]["users"]) == users_wo_role

    api_url = url(base_url, "/users?include_role_users=yes")
    resp = yield http_client.fetch(api_url)
    body = json.loads(resp.body)
    assert resp.code == 200
    assert body["status"] == "ok"
    assert sorted(body["data"]["users"]) == all_users