"""Test suite to verify https scenarios in an orchestration environment."""


import copy

from pytest import meta_suite, meta_test
from pytest import symbols

from . import utils


pytestmark = meta_suite(tags=["func", "marathon", "k8s", "https"])


@meta_test(id="f5mlb-62", tags=[])
def test_https(ssh, orchestration, bigip, bigip_controller):
    """Verify system behavior with basic https config."""
    # - start managed service
    config = _get_https_config()
    svc = utils.create_managed_northsouth_service(
        orchestration,
        health_checks=utils.DEFAULT_SVC_HEALTH_CHECKS_TCP,
        config=config
    )
    utils.wait_for_bigip_controller()
    svc.scale(2)
    assert svc.instances.count() == 2
    utils.wait_for_bigip_controller()
    svc_url = "%s:%s" % (
        utils.DEFAULT_F5MLB_BIND_ADDR, utils.DEFAULT_F5MLB_PORT
    )

    # - verify SSL profile is attached to virtual server on the backend
    obj_name = utils.get_backend_object_name(svc)
    vs = bigip.virtual_server.get(
        name=obj_name, partition=utils.DEFAULT_F5MLB_PARTITION
    )
    profiles = vs.profiles_s.get_collection()
    assert profiles[0].fullPath == "/" + utils.DEFAULT_SVC_SSL_PROFILE

    # - verify http request fails
    http_url = "http://" + svc_url
    curl_cmd = "curl --connect-time 1 -s -k %s" % http_url
    res = ssh.run(symbols.bastion, curl_cmd)
    assert res == ""

    # - verify https request succeeds
    https_url = "https://" + svc_url
    curl_cmd = "curl --connect-time 1 -s -k %s" % https_url
    res = ssh.run(symbols.bastion, curl_cmd)
    assert res.startswith("Hello from")

    # - verify round-robin load balancing
    utils.verify_bigip_round_robin(ssh, svc)


def _get_https_config():
    if symbols.orchestration == "marathon":
        cfg = copy.deepcopy(utils.DEFAULT_SVC_CONFIG)
        cfg['F5_0_SSL_PROFILE'] = utils.DEFAULT_SVC_SSL_PROFILE
    if symbols.orchestration == "k8s":
        cfg = copy.deepcopy(utils.DEFAULT_SVC_CONFIG)
        cfg['data']['data']['virtualServer']['frontend']['sslProfile'] = {
            'f5ProfileName': utils.DEFAULT_SVC_SSL_PROFILE
        }
    return cfg

@@ -428,16 +428,31 @@
 service%0A
+    port = 443%0A
     conf
@@ -474,16 +474,27 @@
 _config(
+'tcp', port
 )%0A    sv
@@ -848,32 +848,12 @@
 DR, 
-utils.DEFAULT_F5MLB_PORT
+port
 %0A   
@@ -871,16 +871,24 @@
  verify 
+tcp and 
 SSL prof
@@ -894,11 +894,13 @@
 file
- is
+s are
  att
@@ -929,16 +929,22 @@
 r on the
+%0A    #
  backend
@@ -1148,78 +1148,211 @@
 n()%0A
+%0A
     
-assert profiles%5B0%5D.fullPath == %22/%22 + utils.DEFAULT_SVC_SSL_PROFILE
+expected_set = set(%5B'/Common/tcp', '/' + utils.DEFAULT_SVC_SSL_PROFILE%5D)%0A    assert len(profiles) == 2%0A    assert profiles%5B0%5D.fullPath in expected_set%0A    assert profiles%5B1%5D.fullPath in expected_set
 %0A%0A  
@@ -1876,16 +1876,26 @@
 _config(
+mode, port
 ):%0A    i
@@ -2047,24 +2047,154 @@
 SSL_PROFILE%0A
+        if mode is not None:%0A            cfg%5B'F5_0_MODE'%5D = mode%0A        if port is not None:%0A            cfg%5B'F5_0_PORT'%5D = port%0A
     if symbo
@@ -2418,16 +2418,261 @@
       %7D%0A
+        if mode is not None:%0A            cfg%5B'data'%5D%5B'data'%5D%5B'virtualServer'%5D%5B'frontend'%5D%5B'mode'%5D = mode%0A        if port is not None:%0A            cfg%5B'data'%5D%5B'data'%5D%5B'virtualServer'%5D%5B'frontend'%5D%5B'virtualAddress'%5D%5B%0A                'port'%5D = port%0A
     retu

add system test for F5_0_MODE is tcp and F5_0_PORT is 443