#
#    Copyright (c) 2022 Project CHIP Authors
#    All rights reserved.
#
#    Licensed under the Apache License, Version 2.0 (the "License");
#    you may not use this file except in compliance with the License.
#    You may obtain a copy of the License at
#
#        http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS,
#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#    See the License for the specific language governing permissions and
#    limitations under the License.
#

import logging

import chip.clusters as Clusters
from chip.interaction_model import Status
from matter_testing_support import MatterBaseTest, TestStep, async_test_body, default_matter_test_main
from mobly import asserts


def acl_subject(cat: int) -> int:
    return 0xFFFFFFFD00000000 | cat


class TC_ACE_1_3(MatterBaseTest):

    async def write_acl(self, acl):
        # This returns an attribute status
        result = await self.default_controller.WriteAttribute(self.dut_node_id, [(0, Clusters.AccessControl.Attributes.Acl(acl))])
        asserts.assert_equal(result[0].Status, Status.Success, "ACL write failed")
        print(result)

    async def read_descriptor_expect_success(self, th):
        cluster = Clusters.Objects.Descriptor
        attribute = Clusters.Descriptor.Attributes.DeviceTypeList
        await self.read_single_attribute_check_success(dev_ctrl=th, endpoint=0, cluster=cluster, attribute=attribute)

    async def read_descriptor_expect_unsupported_access(self, th):
        cluster = Clusters.Objects.Descriptor
        attribute = Clusters.Descriptor.Attributes.DeviceTypeList
        await self.read_single_attribute_expect_error(
            dev_ctrl=th, endpoint=0, cluster=cluster, attribute=attribute, error=Status.UnsupportedAccess)

    def desc_TC_ACE_1_3(self) -> str:
        return "[TC-ACE-1.3] Subjects"

    def steps_TC_ACE_1_3(self) -> list[TestStep]:
        steps = [
            TestStep(1, "Commissioning, already done", is_commissioning=True),
            TestStep(2, "TH0 writes ACL all view on PIXIT.ACE.TESTENDPOINT"),
            TestStep(3, "TH1 reads EP0 descriptor - expect SUCCESS"),
            TestStep(4, "TH2 reads EP0 descriptor - expect SUCCESS"),
            TestStep(5, "TH3 reads EP0 descriptor - expect SUCCESS"),
            TestStep(6, "TH0 writes ACL TH1 view on EP0"),
            TestStep(7, "TH1 reads EP0 descriptor - expect SUCCESS"),
            TestStep(8, "TH2 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(9, "TH3 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(10, "TH0 writes ACL TH2 view on EP0"),
            TestStep(11, "TH1 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(12, "TH2 reads EP0 descriptor - expect SUCCESS"),
            TestStep(13, "TH3 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(14, "TH0 writes ACL TH3 view on EP0"),
            TestStep(15, "TH1 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(16, "TH2 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(17, "TH3 reads EP0 descriptor - expect SUCCESS"),
            TestStep(18, "TH0 writes ACL TH1 TH2 view on EP0"),
            TestStep(19, "TH1 reads EP0 descriptor - expect SUCCESS"),
            TestStep(20, "TH2 reads EP0 descriptor - expect SUCCESS"),
            TestStep(21, "TH3 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(22, "TH0 writes ACL TH1 TH3 view on EP0"),
            TestStep(23, "TH1 reads EP0 descriptor - expect SUCCESS"),
            TestStep(24, "TH2 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(25, "TH3 reads EP0 descriptor - expect SUCCESS"),
            TestStep(26, "TH0 writes ACL TH2 TH3 view on EP0"),
            TestStep(27, "TH1 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(28, "TH2 reads EP0 descriptor - expect SUCCESS"),
            TestStep(29, "TH3 reads EP0 descriptor - expect SUCCESS"),
            TestStep(30, "TH0 writes ACL TH1 TH2 TH3 view on EP0"),
            TestStep(31, "TH1 reads EP0 descriptor - expect SUCCESS"),
            TestStep(32, "TH2 reads EP0 descriptor - expect SUCCESS"),
            TestStep(33, "TH3 reads EP0 descriptor - expect SUCCESS"),
            TestStep(34, "TH0 writes ACL cat1v1 view on EP0"),
            TestStep(35, "TH1 reads EP0 descriptor - expect SUCCESS"),
            TestStep(36, "TH2 reads EP0 descriptor - expect SUCCESS"),
            TestStep(37, "TH3 reads EP0 descriptor - expect SUCCESS"),
            TestStep(38, "TH0 writes ACL cat1v2 view on EP0"),
            TestStep(39, "TH1 reads EP0 descriptor - expect SUCCESS"),
            TestStep(40, "TH2 reads EP0 descriptor - expect SUCCESS"),
            TestStep(41, "TH3 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(42, "TH0 writes ACL cat1v3 view on EP0"),
            TestStep(43, "TH1 reads EP0 descriptor - expect SUCCESS"),
            TestStep(44, "TH2 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(45, "TH3 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(46, "TH0 writes ACL cat2v1 view on EP0"),
            TestStep(47, "TH1 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(48, "TH2 reads EP0 descriptor - expect SUCCESS"),
            TestStep(49, "TH3 reads EP0 descriptor - expect SUCCESS"),
            TestStep(50, "TH0 writes ACL cat2v2 view on EP0"),
            TestStep(51, "TH1 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(52, "TH2 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(53, "TH3 reads EP0 descriptor - expect SUCCESS"),
            TestStep(54, "TH0 writes ACL cat2v3 view on EP0"),
            TestStep(55, "TH1 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(56, "TH2 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(57, "TH3 reads EP0 descriptor - expect UNSUPPORTED_ACCESS"),
            TestStep(58, "TH0 writes ACL back to default")
        ]
        return steps

    @async_test_body
    async def test_TC_ACE_1_3(self):
        cat1_id = 0x11110000
        cat2_id = 0x22220000

        cat1v1 = cat1_id | 0x0001
        cat1v2 = cat1_id | 0x0002
        cat1v3 = cat1_id | 0x0003
        cat2v1 = cat2_id | 0x0001
        cat2v2 = cat2_id | 0x0002
        cat2v3 = cat2_id | 0x0003
        logging.info('cat1v1 0x%x', cat1v1)

        self.step(1)

        fabric_admin = self.certificate_authority_manager.activeCaList[0].adminList[0]

        TH0_nodeid = self.matter_test_config.controller_node_id
        TH1_nodeid = self.matter_test_config.controller_node_id + 1
        TH2_nodeid = self.matter_test_config.controller_node_id + 2
        TH3_nodeid = self.matter_test_config.controller_node_id + 3

        TH1 = fabric_admin.NewController(nodeId=TH1_nodeid,
                                         paaTrustStorePath=str(self.matter_test_config.paa_trust_store_path),
                                         catTags=[cat1v3])
        TH2 = fabric_admin.NewController(nodeId=TH2_nodeid,
                                         paaTrustStorePath=str(self.matter_test_config.paa_trust_store_path),
                                         catTags=[cat1v2, cat2v1])
        TH3 = fabric_admin.NewController(nodeId=TH3_nodeid,
                                         paaTrustStorePath=str(self.matter_test_config.paa_trust_store_path),
                                         catTags=[cat1v1, cat2v2])

        self.step(2)
        TH0_admin_acl = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kAdminister,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH0_nodeid],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0, cluster=0x001f)])
        all_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])
        acl = [TH0_admin_acl, all_view]
        await self.write_acl(acl)

        self.step(3)
        await self.read_descriptor_expect_success(TH1)

        self.step(4)
        await self.read_descriptor_expect_success(TH2)

        self.step(5)
        await self.read_descriptor_expect_success(TH3)

        self.step(6)
        th1_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH1_nodeid],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])
        acl = [TH0_admin_acl, th1_view]
        await self.write_acl(acl)
        self.step(7)
        await self.read_descriptor_expect_success(TH1)

        self.step(8)
        await self.read_descriptor_expect_unsupported_access(TH2)

        self.step(9)
        await self.read_descriptor_expect_unsupported_access(TH3)

        self.step(10)
        th2_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH2_nodeid],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, th2_view]
        await self.write_acl(acl)
        self.step(11)
        await self.read_descriptor_expect_unsupported_access(TH1)

        self.step(12)
        await self.read_descriptor_expect_success(TH2)

        self.step(13)
        await self.read_descriptor_expect_unsupported_access(TH3)

        self.step(14)
        th3_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH3_nodeid],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, th3_view]
        await self.write_acl(acl)
        self.step(15)
        await self.read_descriptor_expect_unsupported_access(TH1)

        self.step(16)
        await self.read_descriptor_expect_unsupported_access(TH2)

        self.step(17)
        await self.read_descriptor_expect_success(TH3)

        self.step(18)
        th12_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH1_nodeid, TH2_nodeid],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, th12_view]
        await self.write_acl(acl)
        self.step(19)
        await self.read_descriptor_expect_success(TH1)

        self.step(20)
        await self.read_descriptor_expect_success(TH2)

        self.step(21)
        await self.read_descriptor_expect_unsupported_access(TH3)

        self.step(22)
        th13_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH1_nodeid, TH3_nodeid],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, th13_view]
        await self.write_acl(acl)
        self.step(23)
        await self.read_descriptor_expect_success(TH1)

        self.step(24)
        await self.read_descriptor_expect_unsupported_access(TH2)

        self.step(25)
        await self.read_descriptor_expect_success(TH3)

        self.step(26)
        th23_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH2_nodeid, TH3_nodeid],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, th23_view]
        await self.write_acl(acl)
        self.step(27)
        await self.read_descriptor_expect_unsupported_access(TH1)

        self.step(28)
        await self.read_descriptor_expect_success(TH2)

        self.step(29)
        await self.read_descriptor_expect_success(TH3)

        self.step(30)
        th123_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH1_nodeid, TH2_nodeid, TH3_nodeid],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, th123_view]
        await self.write_acl(acl)
        self.step(31)
        await self.read_descriptor_expect_success(TH1)

        self.step(32)
        await self.read_descriptor_expect_success(TH2)

        self.step(33)
        await self.read_descriptor_expect_success(TH3)

        self.step(34)
        cat1v1_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[acl_subject(cat1v1)],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])
        acl = [TH0_admin_acl, cat1v1_view]
        await self.write_acl(acl)

        self.step(35)
        await self.read_descriptor_expect_success(TH1)

        self.step(36)
        await self.read_descriptor_expect_success(TH2)

        self.step(37)
        await self.read_descriptor_expect_success(TH3)

        self.step(38)
        cat1v2_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[acl_subject(cat1v2)],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, cat1v2_view]
        await self.write_acl(acl)

        self.step(39)
        await self.read_descriptor_expect_success(TH1)

        self.step(40)
        await self.read_descriptor_expect_success(TH2)

        self.step(41)
        await self.read_descriptor_expect_unsupported_access(TH3)

        self.step(42)
        cat1v3_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[acl_subject(cat1v3)],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, cat1v3_view]
        await self.write_acl(acl)

        self.step(43)
        await self.read_descriptor_expect_success(TH1)

        self.step(44)
        await self.read_descriptor_expect_unsupported_access(TH2)

        self.step(45)
        await self.read_descriptor_expect_unsupported_access(TH3)

        self.step(46)
        cat2v1_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[acl_subject(cat2v1)],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, cat2v1_view]
        await self.write_acl(acl)

        self.step(47)
        await self.read_descriptor_expect_unsupported_access(TH1)

        self.step(48)
        await self.read_descriptor_expect_success(TH2)

        self.step(49)
        await self.read_descriptor_expect_success(TH3)

        self.step(50)
        cat2v2_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[acl_subject(cat2v2)],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, cat2v2_view]
        await self.write_acl(acl)

        self.step(51)
        await self.read_descriptor_expect_unsupported_access(TH1)

        self.step(52)
        await self.read_descriptor_expect_unsupported_access(TH2)

        self.step(53)
        await self.read_descriptor_expect_success(TH3)

        self.step(54)
        cat2v3_view = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kView,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[acl_subject(cat2v3)],
            targets=[Clusters.AccessControl.Structs.AccessControlTargetStruct(endpoint=0)])

        acl = [TH0_admin_acl, cat2v3_view]
        await self.write_acl(acl)

        self.step(55)
        await self.read_descriptor_expect_unsupported_access(TH1)

        self.step(56)
        await self.read_descriptor_expect_unsupported_access(TH2)

        self.step(57)
        await self.read_descriptor_expect_unsupported_access(TH3)

        self.step(58)

        full_acl = Clusters.AccessControl.Structs.AccessControlEntryStruct(
            privilege=Clusters.AccessControl.Enums.AccessControlEntryPrivilegeEnum.kAdminister,
            authMode=Clusters.AccessControl.Enums.AccessControlEntryAuthModeEnum.kCase,
            subjects=[TH0_nodeid],
            targets=[])

        acl = [full_acl]
        await self.write_acl(acl)


if __name__ == "__main__":
    default_matter_test_main()