GCP-IAM

import importlib
import json
from unittest.mock import Mock, patch

import pytest

GCP_IAM = importlib.import_module("GCPIAM")


def get_error_message(resource_name: str, error: str = "Not Found") -> str:
    """
    Get error message.
    Args:
        resource_name (str): The name of the resource which trying to retrieve.
        error (str): Exception message

    Returns:
        str: Error message.

    """
    return f"An error occurred while retrieving {resource_name}.\n {error}"


def load_mock_response(file_path: str) -> str:
    """
    Load mock file that simulates an API response.
    Args:
        file_path (str): Name of the mock response JSON file to return.
    Returns:
        str: Mock file content.
    """
    with open(f"test_data/{file_path}", encoding="utf-8") as mock_file:
        return json.loads(mock_file.read())


@pytest.fixture
def client():
    with patch.object(GCP_IAM.Client, "__init__", lambda x: None):
        mocked_client = GCP_IAM.Client()
        mocked_client.cloud_identity_service = Mock()
        mocked_client.cloud_resource_manager_service = Mock()
        mocked_client.execute_request = Mock()
    return mocked_client


@pytest.mark.parametrize("proxy", [True, False])
def test_the_test_module_with_proxy(mocker, proxy: bool):
    """
    Given:
     - Case A: proxy = True
     - Case B: proxy = False

    When:
     - calling test-module

    Then:
     - Ensure that the test-module doesn't raise an exception in both cases
    """

    class MockedServiceAccountCredentials:
        def authorize(self, value):
            return value

    from GCPIAM import Client, service_account, test_module

    mocker.patch.object(
        service_account.ServiceAccountCredentials, "from_json_keyfile_dict", return_value=MockedServiceAccountCredentials()
    )
    mocker.patch.object(
        Client, "gcp_iam_predefined_role_list_request", return_value=load_mock_response("role/predefined_role_list.json")
    )

    # make sure an exception isn't raised
    test_module("{}", proxy=proxy, verify_certificate=False)


def test_get_http_client_with_proxy(client):
    """
    Given:
     - configured proxies

    When:
     - get_http_client_with_proxy method

    Then:
     - Ensure proxy info is fulfilled for the http client.
    """
    http_info = client.get_http_client_with_proxy(proxies={"https": "https://test.com"})
    assert http_info.proxy_info


def test_get_http_client_no_proxies(client):
    """
    Given:
     - proxies that are not configured

    When:
     - get_http_client_with_proxy method

    Then:
     - Ensure proxy info is not fulfilled for the http client.
    """
    http_info = client.get_http_client_with_proxy(proxies={})
    assert not http_info.proxy_info


def test_gcp_iam_project_list_command(client):
    """
    Scenario: list projects.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("project/project_list.json")
    client.gcp_iam_project_list_request = Mock(return_value=mock_response)
    parent = "organizations/xsoar-organization"
    result = GCP_IAM.gcp_iam_projects_get_command(client, {"parent": parent})

    assert len(result[0].outputs) == 2
    assert result[0].outputs_prefix == "GCPIAM.Project"
    assert result[0].outputs[0].get("name") == "projects/project-name-1"


def test_gcp_iam_project_get_command(client):
    """
    Scenario: get project.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("project/project_get.json")
    client.gcp_iam_project_get_request = Mock(return_value=mock_response)
    project_name = "projects/project-name-1"
    result = GCP_IAM.gcp_iam_projects_get_command(client, {"project_name": project_name})

    assert len(result[0].outputs) == 1
    assert result[0].outputs_prefix == "GCPIAM.Project"
    assert result[0].outputs[0].get("name") == project_name

    client.gcp_iam_project_get_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_projects_get_command(client, {"project_name": project_name})
    assert result[0].readable_output == get_error_message(project_name)


@pytest.mark.parametrize(
    "project_name, roles, expected_bindings_length, expected_role, expected_readable_output",
    [
        ("projects/project-name-1", "roles/browser", 1, "roles/browser", "Current page size: 1"),
        ("projects/project-name-1", None, 2, "roles/anthosidentityservice.serviceAgent", "Current page size: 2"),
    ],
)
def test_gcp_iam_project_iam_policy_get_command(
    client, project_name, roles, expected_bindings_length, expected_role, expected_readable_output
):
    """
    Scenario: Retrieve the IAM access control policy for the specified project.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-iam-policy-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("project/project_iam_policy_get.json")
    client.gcp_iam_project_iam_policy_get_request = Mock(return_value=mock_response)
    result = GCP_IAM.gcp_iam_project_iam_policy_get_command(client, {"project_name": project_name, "roles": roles})

    assert len(result.outputs.get("bindings")) == expected_bindings_length
    assert result.outputs_prefix == "GCPIAM.Policy"
    assert result.outputs.get("name") == project_name
    assert result.outputs.get("bindings")[0].get("role") == expected_role
    assert expected_readable_output in result.readable_output


def test_gcp_iam_project_iam_test_permission_command(client):
    """
    Scenario: Retrieve permissions that a caller has on the specified project.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-iam-permission-test called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("project/project_iam_test_permission.json")
    client.gcp_iam_project_iam_test_permission_request = Mock(return_value=mock_response)
    project_name = "projects/project-name-1"
    permissions = "compute.instances.create,aiplatform.dataItems.create"
    result = GCP_IAM.gcp_iam_project_iam_test_permission_command(
        client, {"project_name": project_name, "permissions": permissions}
    )

    assert len(result.outputs) == 2
    assert result.outputs_prefix == "GCPIAM.Permission"
    assert result.outputs[1].get("name") == "compute.instances.create"
    assert result.outputs[0].get("name") == "aiplatform.dataItems.create"


def test_gcp_iam_project_iam_member_add_command(client):
    """
    Scenario: Add members to project policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-iam-member-add called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("project/project_iam_policy_set.json")
    client.gcp_iam_project_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("project/project_iam_policy_get.json")
    client.gcp_iam_project_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    project_name = "projects/project-name-1"
    member = "user:user-1@xsoar.com"
    role = "roles/browser"
    command_args = {"project_name": project_name, "role": role, "members": member}

    result = GCP_IAM.gcp_iam_project_iam_member_add_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_project_iam_member_remove_command(client):
    """
    Scenario: Remove members from project policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-iam-member-remove called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("project/project_iam_policy_set.json")
    client.gcp_iam_project_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("project/project_iam_policy_get.json")
    client.gcp_iam_project_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    project_name = "projects/project-name-1"
    member = "group:poctest@xsoar.com"
    role = "roles/browser"
    command_args = {"project_name": project_name, "role": role, "members": member}

    result = GCP_IAM.gcp_iam_project_iam_member_remove_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_project_iam_policy_set_command(client):
    """
    Scenario: Sets the IAM access control policy for the specified project.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-iam-policy-set called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("project/project_iam_policy_set.json")
    client.gcp_iam_project_iam_policy_set_request = Mock(return_value=mock_response)

    policy = [
        {
            "role": "roles/owner",
            "members": [
                "group:poctest@xsoar.com",
                "serviceAccount:service-account-2@project-id-1.iam.gserviceaccount.com",
                "user:user-1@xsoar.com",
            ],
        },
        {
            "role": "roles/browser",
            "members": ["serviceAccount:service-account-2@project-id-1.iam.gserviceaccount.com", "user:user-1@xsoar.com"],
        },
    ]

    project_name = "projects/project-name-1"

    command_args = {"project_name": project_name, "policy": json.dumps(policy)}

    result = GCP_IAM.gcp_iam_project_iam_policy_set_command(client, command_args)

    assert len(result.outputs.get("bindings")) == 2
    assert result.outputs_prefix == "GCPIAM.Policy"
    assert result.outputs.get("name") == project_name
    assert result.outputs.get("bindings") == policy


def test_gcp_iam_project_iam_policy_add_command(client):
    """
    Scenario: Add new project IAM policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-iam-policy-create called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("project/project_iam_policy_set.json")
    client.gcp_iam_project_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("project/project_iam_policy_get.json")
    client.gcp_iam_project_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    project_name = "projects/project-name-1"
    role = "roles/browser"
    members = ["serviceAccount:service-account-2@project-id-1.iam.gserviceaccount.com", "user:user-1@xsoar.com"]
    command_args = {"project_name": project_name, "role": role, "members": members}

    result = GCP_IAM.gcp_iam_project_iam_policy_add_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_project_iam_policy_remove_command(client):
    """
    Scenario: Remove policy from project IAM policies.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folder-iam-policy-remove called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("project/project_iam_policy_set.json")
    client.gcp_iam_project_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("project/project_iam_policy_get.json")
    client.gcp_iam_project_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    project_name = "projects/project-name-1"
    role = "roles/browser"
    command_args = {"project_name": project_name, "role": role}

    result = GCP_IAM.gcp_iam_project_iam_policy_remove_command(client, command_args)

    assert result.readable_output == f"Project {project_name} IAM policies updated successfully."


def test_gcp_iam_group_create_command(client):
    """
    Scenario: Create a new group.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("group/group_create.json")
    client.gcp_iam_group_create_request = Mock(return_value=mock_response)

    parent = "customers/xsoar-customer-id"
    display_name = "xsoar-api-test-2"
    description = "api-test-2"
    group_email_address = "poctest12@xsoar.com"

    command_args = {
        "parent": parent,
        "display_name": display_name,
        "description": description,
        "group_email_address": group_email_address,
    }

    result = GCP_IAM.gcp_iam_group_create_command(client, command_args)

    assert len(result.outputs) == 1
    assert len(result.outputs[0]) == 9
    assert result.outputs_prefix == "GCPIAM.Group"
    assert result.outputs[0].get("parent") == parent
    assert result.outputs[0].get("displayName") == display_name
    assert result.outputs[0].get("description") == description
    assert result.outputs[0].get("groupKey").get("id") == group_email_address


def test_gcp_iam_group_list_command(client):
    """
    Scenario: List groups under the specified parent.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("group/group_list.json")
    client.gcp_iam_group_list_request = Mock(return_value=mock_response)

    parent = "customers/xsoar-customer-id"

    command_args = {"parent": parent}

    result = GCP_IAM.gcp_iam_group_list_command(client, command_args)

    assert len(result.outputs) == 2
    assert len(result.outputs[0]) == 3
    assert result.outputs_prefix == "GCPIAM.Group"
    assert result.outputs[0].get("name") == "groups/group-3-name"
    assert result.outputs[0].get("displayName") == "xsoar-api-test-2"
    assert result.outputs[0].get("groupKey").get("id") == "poctest1@xsoar.com"


def test_gcp_iam_group_get_command(client):
    """
    Scenario: Retrieve group information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("group/group_get.json")
    client.gcp_iam_group_get_request = Mock(return_value=mock_response)

    group_name = "groups/group-1-name"

    command_args = {"group_name": group_name}

    result = GCP_IAM.gcp_iam_group_get_command(client, command_args)

    assert len(result.outputs) == 1
    assert len(result.outputs[0]) == 8
    assert result.outputs_prefix == "GCPIAM.Group"
    assert result.outputs[0].get("name") == "groups/group-1-name"
    assert result.outputs[0].get("displayName") == "xsoar-api-test-2"
    assert result.outputs[0].get("groupKey").get("id") == "poctest12@xsoar.com"


def test_gcp_iam_group_delete_command(client):
    """
    Scenario: Delete group.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-delete called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("group/group_delete.json")
    client.gcp_iam_group_delete_request = Mock(return_value=mock_response)

    group_name = "groups/group-1-name"

    command_args = {"group_name": group_name}

    result = GCP_IAM.gcp_iam_group_delete_command(client, command_args)

    assert result.readable_output == f"Group {group_name} was successfully deleted."


def test_gcp_iam_group_membership_create_command(client):
    """
    Scenario: Create a group membership.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-membership-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("group/group_membership_create.json")
    client.gcp_iam_group_membership_create_request = Mock(return_value=mock_response)

    group_name = "groups/group-3-name"
    member_email = "user-2@xsoar.com"
    role = "MEMBER"

    command_args = {"groups_name": group_name, member_email: member_email, role: role}

    result = GCP_IAM.gcp_iam_group_membership_create_command(client, command_args)

    assert len(result) == 1
    assert len(result[0].outputs) == 1
    assert len(result[0].outputs[0]) == 4
    assert result[0].outputs_prefix == "GCPIAM.Membership"
    assert result[0].outputs[0].get("name") == "groups/group-3-name/memberships/membership-1"
    assert result[0].outputs[0].get("roles")[0].get("name") == role
    assert result[0].outputs[0].get("preferredMemberKey").get("id") == member_email

    client.gcp_iam_group_membership_create_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_group_membership_create_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while creating membership in group {group_name}.\n Not Found"


def test_gcp_iam_group_membership_list_command(client):
    """
    Scenario: List group memberships.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-membership-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("group/group_membership_list.json")
    client.gcp_iam_group_membership_list_request = Mock(return_value=mock_response)

    group_name = "groups/group-3-name"

    command_args = {"group_name": group_name}

    result = GCP_IAM.gcp_iam_group_membership_list_command(client, command_args)

    assert len(result.outputs) == 2
    assert len(result.outputs[0]) == 3
    assert result.outputs_prefix == "GCPIAM.Membership"
    assert result.outputs[0].get("name") == "groups/group-3-name/memberships/membership-1"
    assert result.outputs[0].get("roles")[0].get("name") == "MEMBER"
    assert result.outputs[0].get("preferredMemberKey").get("id") == "user-2@xsoar.com"


def test_gcp_iam_group_membership_get_command(client):
    """
    Scenario: Retrieve group membership information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-membership-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("group/group_membership_get.json")
    client.gcp_iam_group_membership_get_request = Mock(return_value=mock_response)

    membership_name = "groups/group-2-name/memberships/membership-2"

    command_args = {"membership_name": membership_name}

    result = GCP_IAM.gcp_iam_group_membership_get_command(client, command_args)

    assert len(result.outputs) == 1
    assert len(result.outputs[0]) == 6
    assert result.outputs_prefix == "GCPIAM.Membership"
    assert result.outputs[0].get("name") == membership_name
    assert result.outputs[0].get("roles")[1].get("name") == "MEMBER"
    assert result.outputs[0].get("preferredMemberKey").get("id") == "service-account-1@project-id-1.iam.gserviceaccount.com"


def test_gcp_iam_group_membership_role_add_command(client):
    """
    Scenario: Add group membership role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-membership-role-add called.
    Then:
     - Ensure results readable output..
    """
    mock_response = load_mock_response("group/group_membership_add_role.json")
    client.gcp_iam_group_membership_role_add_request = Mock(return_value=mock_response)

    membership_name = "groups/group-2-name/memberships/membership-2"

    command_args = {"membership_name": membership_name, "role": "OWNER"}

    result = GCP_IAM.gcp_iam_group_membership_role_add_command(client, command_args)

    assert result.readable_output == f"Membership {membership_name} updated successfully."


def test_gcp_iam_group_membership_role_remove_command(client):
    """
    Scenario: Remove group membership role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-membership-role-remove called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("group/group_membership_remove_role.json")
    client.gcp_iam_group_membership_role_remove_request = Mock(return_value=mock_response)

    membership_name = "groups/group-2-name/memberships/membership-2"

    command_args = {"membership_name": membership_name, "role": "OWNER"}

    result = GCP_IAM.gcp_iam_group_membership_role_remove_command(client, command_args)

    assert result.readable_output == f"Membership {membership_name} updated successfully."


def test_gcp_iam_group_membership_delete_request(client):
    """
    Scenario: Delete group membership.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-group-membership-delete called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("group/group_membership_delete.json")
    client.gcp_iam_group_membership_delete_request = Mock(return_value=mock_response)

    membership_name = "groups/group-2-name/memberships/membership-2"

    command_args = {"membership_names": membership_name}

    result = GCP_IAM.gcp_iam_group_membership_delete_command(client, command_args)

    assert len(result) == 1
    assert result[0].readable_output == f"Membership {membership_name} deleted successfully."

    client.gcp_iam_group_membership_delete_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_group_membership_delete_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while deleting the membership {membership_name}.\n Not Found"


def test_gcp_iam_testable_permission_list_command(client):
    """
    Lists permissions that can be tested on a resource.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-testable-permission-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("permission/query_resource_permissions.json")
    client.gcp_iam_testable_permission_list_request = Mock(return_value=mock_response)

    resource_name = "groups/group-2-name"

    command_args = {"resource_name": resource_name}

    result = GCP_IAM.gcp_iam_testable_permission_list_command(client, command_args)

    assert len(result.outputs) == 3
    assert len(result.outputs[0]) == 2
    assert result.outputs_prefix == "GCPIAM.Permission"
    assert result.outputs[0].get("name") == "accessapproval.requests.approve"
    assert result.outputs[0].get("stage") == "BETA"


def test_gcp_iam_grantable_role_list_command(client):
    """
    Lists roles that can be granted on a Google Cloud resource.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-grantable-role-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/grantable_role_list.json")
    client.gcp_iam_grantable_role_list_request = Mock(return_value=mock_response)

    resource_name = "organizations/organization-name"

    command_args = {"resource_name": resource_name}

    result = GCP_IAM.gcp_iam_grantable_role_list_command(client, command_args)

    assert len(result.outputs) == 2
    assert len(result.outputs[0]) == 3
    assert result.outputs_prefix == "GCPIAM.Roles"
    assert result.outputs[0].get("name") == "roles/accessapproval.approver"
    assert result.outputs[0].get("title") == "Access Approval Approver"


def test_gcp_iam_service_account_create_command(client):
    """
    Create a service account in project.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("service_account/service_account_create.json")
    client.gcp_iam_service_account_create_request = Mock(return_value=mock_response)

    project_name = "projects/project-id-1"
    service_account_id = "poc-test12"
    display_name = "user-1-display-name"
    description = "my poc service"

    command_args = {
        "project_name": project_name,
        "service_account_id": service_account_id,
        "display_name": display_name,
        "description": description,
    }

    result = GCP_IAM.gcp_iam_service_account_create_command(client, command_args)

    assert len(result.outputs) == 1
    assert len(result.outputs[0]) == 9
    assert result.outputs_prefix == "GCPIAM.ServiceAccount"
    assert result.outputs[0].get("description") == description


def test_gcp_iam_service_account_update_command(client):
    """
    Update service account.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-update called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_service_account_update_request = Mock(return_value={})

    service_account_name = "projects/project-id-1/serviceAccounts/poc-test12@project-name-1.iam.gserviceaccount.com"
    service_account_id = "poc-test12"
    display_name = "user-1-display-name"
    description = "my poc service"

    command_args = {
        "service_account_name": service_account_name,
        "service_account_id": service_account_id,
        "display_name": display_name,
        "description": description,
    }

    result = GCP_IAM.gcp_iam_service_account_update_command(client, command_args)

    assert result.readable_output == f"Service account {service_account_name} updated successfully."


def test_gcp_iam_service_account_list_command(client):
    """
    List service accounts in project.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-update called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("service_account/service_account_list.json")
    client.gcp_iam_service_account_list_request = Mock(return_value=mock_response)

    project_name = "projects/project-id-1"

    command_args = {"project_name": project_name}

    result = GCP_IAM.gcp_iam_service_accounts_get_command(client, command_args)

    assert len(result.outputs) == 2
    assert len(result.outputs[0]) == 8
    assert result.outputs_prefix == "GCPIAM.ServiceAccount"
    assert result.outputs[0].get("projectId") == "project-id-1"


def test_gcp_iam_service_account_get_command(client):
    """
    Retrieve project service account information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("service_account/service_account_get.json")
    client.gcp_iam_service_account_get_request = Mock(return_value=mock_response)

    service_account_name = "projects/project-id-1/serviceAccounts/poc-test12@project-name-1.iam.gserviceaccount.com"

    command_args = {"service_account_name": service_account_name}

    result = GCP_IAM.gcp_iam_service_accounts_get_command(client, command_args)

    assert len(result) == 1
    assert len(result[0].outputs) == 1
    assert len(result[0].outputs[0]) == 9
    assert result[0].outputs_prefix == "GCPIAM.ServiceAccount"
    assert result[0].outputs[0].get("projectId") == "project-id-1"

    client.gcp_iam_service_account_get_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_service_accounts_get_command(client, command_args)
    assert result[0].readable_output == get_error_message(service_account_name)


def test_gcp_iam_service_account_enable_command(client):
    """
    Enable project service account.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-enable called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_service_account_enable_request = Mock(return_value={})

    service_account_name = "projects/project-id-1/serviceAccounts/poc-test12@project-name-1.iam.gserviceaccount.com"

    command_args = {"service_account_name": service_account_name}

    result = GCP_IAM.gcp_iam_service_account_enable_command(client, command_args)

    assert result[0].readable_output == f"Service account {service_account_name} updated successfully."

    client.gcp_iam_service_account_enable_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_service_account_enable_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while trying to enable {service_account_name}.\n Not Found"


def test_gcp_iam_service_account_disable_command(client):
    """
    Disable project service account.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-disable called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_service_account_disable_request = Mock(return_value={})

    service_account_name = "projects/project-id-1/serviceAccounts/poc-test12@project-name-1.iam.gserviceaccount.com"

    command_args = {"service_account_name": service_account_name}

    result = GCP_IAM.gcp_iam_service_account_disable_command(client, command_args)

    assert result[0].readable_output == f"Service account {service_account_name} updated successfully."

    client.gcp_iam_service_account_disable_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_service_account_disable_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while trying to disable {service_account_name}.\n Not Found"


def test_gcp_iam_service_account_delete_command(client):
    """
    Delete project service account.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-delete called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_service_account_delete_request = Mock(return_value={})

    service_account_name = "projects/project-id-1/serviceAccounts/poc-test12@project-name-1.iam.gserviceaccount.com"

    command_args = {"service_account_name": service_account_name}

    result = GCP_IAM.gcp_iam_service_account_delete_command(client, command_args)

    assert result[0].readable_output == f"Service account {service_account_name} deleted successfully."

    client.gcp_iam_service_account_delete_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_service_account_delete_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while trying to delete {service_account_name}.\n Not Found"


def test_gcp_iam_service_account_key_create_command(client):
    """
    Create a service account key.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-key-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("service_account_key/service_account_key_create.json")
    client.gcp_iam_service_account_key_create_request = Mock(return_value=mock_response)

    service_account_name = "projects/project-id-1/serviceAccounts/test-2@project-id-1.iam.gserviceaccount.com"

    command_args = {"service_account_name": service_account_name}

    result = GCP_IAM.gcp_iam_service_account_key_create_command(client, command_args)

    assert len(result.outputs) == 1
    assert len(result.outputs[0]) == 9
    assert result.outputs_prefix == "GCPIAM.ServiceAccountKey"
    assert result.outputs[0].get("privateKeyData") == "my-private-key-data"
    assert not result.outputs[0].get("disabled")


def test_gcp_iam_service_account_key_list_command(client):
    """
    List service accounts keys.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-key-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("service_account_key/service_account_key_list.json")
    client.gcp_iam_service_account_key_list_request = Mock(return_value=mock_response)

    service_account_name = "projects/project-id-1/serviceAccounts/test-2@project-id-1.iam.gserviceaccount.com"

    command_args = {"service_account_name": service_account_name}

    result = GCP_IAM.gcp_iam_service_account_keys_get_command(client, command_args)

    assert len(result.outputs) == 2
    assert len(result.outputs[0]) == 7
    assert result.outputs_prefix == "GCPIAM.ServiceAccountKey"
    assert not result.outputs[1].get("disabled")
    assert (
        result.outputs[1].get("name") == "projects/project-id-1/serviceAccounts/"
        "integration-test-5@395661807466.iam.gserviceaccount.com/keys/service-account-key-1"
    )


def test_gcp_iam_service_account_key_get_command(client):
    """
    Retrieve service account key information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-key-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("service_account_key/service_account_key_get.json")
    client.gcp_iam_service_account_key_get_request = Mock(return_value=mock_response)

    key_name = (
        "projects/project-id-1/serviceAccounts/"
        "integration-test-5@395661807466.iam.gserviceaccount.com/keys/service-account-key-1"
    )

    command_args = {"key_name": key_name}

    result = GCP_IAM.gcp_iam_service_account_keys_get_command(client, command_args)

    assert len(result.outputs) == 1
    assert len(result.outputs[0]) == 7
    assert result.outputs_prefix == "GCPIAM.ServiceAccountKey"
    assert not result.outputs[0].get("disabled")
    assert (
        result.outputs[0].get("name") == "projects/project-id-1/serviceAccounts/"
        "integration-test-5@395661807466.iam.gserviceaccount.com/keys/service-account-key-1"
    )


def test_gcp_iam_service_account_key_enable_command(client):
    """
    Enable service account key.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-enable called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_service_account_key_enable_request = Mock(return_value={})

    key_name = (
        "projects/project-id-1/serviceAccounts/"
        "integration-test-5@395661807466.iam.gserviceaccount.com/keys/service-account-key-1"
    )

    command_args = {"key_name": key_name}

    result = GCP_IAM.gcp_iam_service_account_key_enable_command(client, command_args)

    assert result[0].readable_output == f"Service account key {key_name} updated successfully."

    client.gcp_iam_service_account_key_enable_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_service_account_key_enable_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while trying to enable {key_name}.\n Not Found"


def test_gcp_iam_service_account_key_disable_command(client):
    """
    Disable service account key.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-disable called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_service_account_key_disable_request = Mock(return_value={})

    key_name = (
        "projects/project-id-1/serviceAccounts/"
        "integration-test-5@395661807466.iam.gserviceaccount.com/keys/service-account-key-1"
    )

    command_args = {"key_name": key_name}

    result = GCP_IAM.gcp_iam_service_account_key_disable_command(client, command_args)

    assert result[0].readable_output == f"Service account key {key_name} updated successfully."

    client.gcp_iam_service_account_key_disable_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_service_account_key_disable_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while trying to disable {key_name}.\n Not Found"


def test_gcp_iam_service_account_key_delete_command(client):
    """
    Delete service account key.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-service-account-delete called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_service_account_key_delete_request = Mock(return_value={})

    key_name = (
        "projects/project-id-1/serviceAccounts/"
        "integration-test-5@395661807466.iam.gserviceaccount.com/keys/service-account-key-1"
    )

    command_args = {"key_name": key_name}

    result = GCP_IAM.gcp_iam_service_account_key_delete_command(client, command_args)

    assert result[0].readable_output == f"Service account key {key_name} deleted successfully."

    client.gcp_iam_service_account_key_delete_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_service_account_key_delete_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while trying to delete {key_name}.\n Not Found"


def test_gcp_iam_organization_role_create_command(client):
    """
    Create a custom organization role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-role-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/organization_role_create.json")
    client.gcp_iam_organization_role_create_request = Mock(return_value=mock_response)

    organization_name = "organizations/xsoar-organization"
    role_id = "xsoar_demo_97"

    command_args = {"organization_name": organization_name, "role_id": role_id}

    result = GCP_IAM.gcp_iam_organization_role_create_command(client, command_args)

    assert len(result.outputs) == 1
    assert len(result.outputs[0]) == 7
    assert result.outputs_prefix == "GCPIAM.Role"
    assert result.outputs[0].get("stage") == "ALPHA"
    assert result.outputs[0].get("name") == f"{organization_name}/roles/{role_id}"


def test_gcp_iam_project_role_create_command(client):
    """
    Create a custom project role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-role-create called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/project_role_create.json")
    client.gcp_iam_project_role_create_request = Mock(return_value=mock_response)

    project_id = "xsoar-project-5"
    role_id = "test_xsoar_role"

    command_args = {"project_id": project_id, "role_id": role_id}

    result = GCP_IAM.gcp_iam_project_role_create_command(client, command_args)

    assert len(result.outputs) == 1
    assert len(result.outputs[0]) == 7
    assert result.outputs_prefix == "GCPIAM.Role"
    assert result.outputs[0].get("stage") == "ALPHA"
    assert result.outputs[0].get("name") == f"projects/{project_id}/roles/{role_id}"


def test_gcp_iam_organization_role_get_command(client):
    """
    Retrieve organization role information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-role-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/organization_role_get.json")
    client.gcp_iam_organization_role_get_request = Mock(return_value=mock_response)

    role_name = "organizations/xsoar-organization/roles/xsoar_demo_97"

    command_args = {"role_name": role_name}

    result = GCP_IAM.gcp_iam_organization_role_get_command(client, command_args)

    assert len(result[0].outputs) == 1
    assert len(result[0].outputs[0]) == 7
    assert result[0].outputs_prefix == "GCPIAM.Role"
    assert result[0].outputs[0].get("stage") == "ALPHA"
    assert result[0].outputs[0].get("name") == role_name

    client.gcp_iam_organization_role_get_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_organization_role_get_command(client, command_args)
    assert result[0].readable_output == get_error_message(role_name)


def test_gcp_iam_project_role_get_command(client):
    """
    Retrieve project role information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-role-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/project_role_get.json")
    client.gcp_iam_project_role_get_request = Mock(return_value=mock_response)

    role_name = "projects/xsoar-project-5/roles/test_xsoar_role"

    command_args = {"role_name": role_name}

    result = GCP_IAM.gcp_iam_project_role_get_command(client, command_args)

    assert len(result[0].outputs) == 1
    assert len(result[0].outputs[0]) == 7
    assert result[0].outputs_prefix == "GCPIAM.Role"
    assert result[0].outputs[0].get("stage") == "ALPHA"
    assert result[0].outputs[0].get("name") == role_name

    client.gcp_iam_project_role_get_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_project_role_get_command(client, command_args)
    assert result[0].readable_output == get_error_message(role_name)


def test_gcp_iam_organization_role_list_command(client):
    """
    List organization custom roles.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-role-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/organization_role_list.json")
    client.gcp_iam_organization_role_list_request = Mock(return_value=mock_response)

    organization_name = "organizations/xsoar-organization"
    include_permissions = "True"

    command_args = {"organization_name": organization_name, "include_permissions": include_permissions}

    result = GCP_IAM.gcp_iam_organization_role_list_command(client, command_args)

    assert len(result.outputs) == 2
    assert len(result.outputs[0]) == 7
    assert result.outputs_prefix == "GCPIAM.Role"
    assert result.outputs[0].get("stage") == "ALPHA"
    assert result.outputs[1].get("name") == "organizations/xsoar-organization/roles/xsoar_demo_97"


def test_gcp_iam_project_role_list_command(client):
    """
    List project custom roles.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-role-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/project_role_list.json")
    client.gcp_iam_project_role_list_request = Mock(return_value=mock_response)

    project_id = "xsoar-project-5"
    include_permissions = "True"

    command_args = {"project_id": project_id, "include_permissions": include_permissions}

    result = GCP_IAM.gcp_iam_project_role_list_command(client, command_args)

    assert len(result.outputs) == 2
    assert len(result.outputs[0]) == 7
    assert len(result.outputs[1]) == 7
    assert result.outputs_prefix == "GCPIAM.Role"
    assert result.outputs[0].get("stage") == "ALPHA"
    assert result.outputs[1].get("name") == "projects/xsoar-project-5/roles/test_xsoar_role"


def test_gcp_iam_predefined_role_list_command(client):
    """
    Lists every predefined Role that IAM supports.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-role-list called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/predefined_role_list.json")
    client.gcp_iam_predefined_role_list_request = Mock(return_value=mock_response)

    include_permissions = "True"

    command_args = {"include_permissions": include_permissions}

    result = GCP_IAM.gcp_iam_predefined_role_list_command(client, command_args)

    assert len(result.outputs) == 2
    assert len(result.outputs[0]) == 7
    assert result.outputs_prefix == "GCPIAM.Role"
    assert result.outputs[0].get("stage") == "BETA"
    assert result.outputs[1].get("name") == "roles/accessapproval.configEditor"


def test_gcp_iam_predefined_role_get_command(client):
    """
    Retrieve predefined role information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-role-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("role/predefined_role_get.json")
    client.gcp_iam_predefined_role_get_request = Mock(return_value=mock_response)

    role_name = "roles/accessapproval.approver"

    command_args = {"role_name": role_name}

    result = GCP_IAM.gcp_iam_predefined_role_get_command(client, command_args)

    assert len(result[0].outputs) == 1
    assert len(result[0].outputs[0]) == 7
    assert result[0].outputs_prefix == "GCPIAM.Role"
    assert result[0].outputs[0].get("stage") == "BETA"
    assert result[0].outputs[0].get("name") == role_name

    client.gcp_iam_predefined_role_get_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_predefined_role_get_command(client, command_args)
    assert result[0].readable_output == get_error_message(role_name)


def test_gcp_iam_organization_role_update_command(client):
    """
    Update an organization custom role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-role-update called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_organization_role_update_request = Mock(return_value={})

    role_name = "organizations/xsoar-organization/roles/xsoar_demo_97"
    title = "new title"
    fields_to_update = "title"
    command_args = {"role_name": role_name, "title": title, "fields_to_update": fields_to_update}

    result = GCP_IAM.gcp_iam_organization_role_update_command(client, command_args)

    assert result.readable_output == f"Role {role_name} updated successfully."


def test_gcp_iam_project_role_update_command(client):
    """
    Update an project custom role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-role-update called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_project_role_update_request = Mock(return_value={})

    role_name = "projects/xsoar-project-5/roles/test_xsoar_role"
    title = "new title"
    fields_to_update = "title"
    command_args = {"role_name": role_name, "title": title, "fields_to_update": fields_to_update}

    result = GCP_IAM.gcp_iam_project_role_update_command(client, command_args)

    assert result.readable_output == f"Role {role_name} updated successfully."


def test_gcp_iam_organization_role_permission_add_command(client):
    """
    Add permissions to custom organization role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-role-permission-add called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_organization_role_update_request = Mock(return_value={})
    mock_response = load_mock_response("role/organization_role_get.json")
    client.gcp_iam_organization_role_get_request = Mock(return_value=mock_response)

    role_name = "organizations/xsoar-organization/roles/xsoar_demo_97"
    permissions = "aiplatform.artifacts.get,aiplatform.artifacts.list"
    command_args = {"role_name": role_name, "permissions": permissions}

    result = GCP_IAM.gcp_iam_organization_role_permission_add_command(client, command_args)

    assert result.readable_output == f"Role {role_name} updated successfully."


def test_gcp_iam_project_role_permission_add_command(client):
    """
    Add permissions to custom project role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-role-permission-add called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_project_role_update_request = Mock(return_value={})
    mock_response = load_mock_response("role/project_role_get.json")
    client.gcp_iam_project_role_get_request = Mock(return_value=mock_response)

    role_name = "projects/xsoar-project-5/roles/test_xsoar_role"
    permissions = "aiplatform.artifacts.get,aiplatform.artifacts.list"
    command_args = {"role_name": role_name, "permissions": permissions}

    result = GCP_IAM.gcp_iam_project_role_permission_add_command(client, command_args)

    assert result.readable_output == f"Role {role_name} updated successfully."


def test_gcp_iam_organization_role_permission_remove_command(client):
    """
    Remove permissions from custom organization role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-role-permission-remove called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_organization_role_update_request = Mock(return_value={})
    mock_response = load_mock_response("role/organization_role_get.json")
    client.gcp_iam_organization_role_get_request = Mock(return_value=mock_response)

    role_name = "organizations/xsoar-organization/roles/xsoar_demo_97"
    permissions = "aiplatform.artifacts.get"

    command_args = {"role_name": role_name, "permissions": permissions}

    result = GCP_IAM.gcp_iam_organization_role_permission_remove_command(client, command_args)

    assert result.readable_output == f"Role {role_name} updated successfully."


def test_gcp_iam_project_role_permission_remove_command(client):
    """
    Remove permissions from custom project role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-role-permission-remove called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_project_role_update_request = Mock(return_value={})
    mock_response = load_mock_response("role/project_role_get.json")
    client.gcp_iam_project_role_get_request = Mock(return_value=mock_response)

    role_name = "projects/xsoar-project-5/roles/test_xsoar_role"
    permissions = "aiplatform.artifacts.get"

    command_args = {"role_name": role_name, "permissions": permissions}

    result = GCP_IAM.gcp_iam_project_role_permission_add_command(client, command_args)

    assert result.readable_output == f"Role {role_name} updated successfully."


def test_gcp_iam_organization_role_permission_remove_command_exception(client):
    """
    Remove permissions from custom organization role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-role-permission-remove called.
     - User has provided invalid command arguments.
    Then:
     - Ensure command raise exception.
    """
    client.gcp_iam_organization_role_update_request = Mock(return_value={})
    mock_response = load_mock_response("role/organization_role_get.json")
    client.gcp_iam_organization_role_get_request = Mock(return_value=mock_response)

    role_name = "organizations/xsoar-organization/roles/xsoar_demo_97"
    permissions = "aiplatform.artifacts.get,aiplatform.artifacts.list"
    command_args = {"role_name": role_name, "permissions": permissions}

    with pytest.raises(Exception):
        GCP_IAM.gcp_iam_organization_role_permission_remove_command(client, command_args)


def test_gcp_iam_project_role_permission_remove_command_exception(client):
    """
    Remove permissions from custom project role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-role-permission-remove called.
     - User has provided invalid command arguments.
    Then:
     - Ensure command raise exception.
    """
    client.gcp_iam_project_role_get_request = Mock(return_value={})
    mock_response = load_mock_response("role/project_role_get.json")
    client.gcp_iam_project_role_update_request = Mock(return_value=mock_response)

    role_name = "projects/xsoar-project-5/roles/test_xsoar_role"
    permissions = "aiplatform.artifacts.get,aiplatform.artifacts.list"
    command_args = {"role_name": role_name, "permissions": permissions}

    with pytest.raises(Exception):
        GCP_IAM.gcp_iam_project_role_permission_remove_command(client, command_args)


def test_gcp_iam_organization_role_delete_command(client):
    """
    Delete a custom organization role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-role-delete called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_organization_role_delete_request = Mock(return_value={})

    role_name = "organizations/xsoar-organization/roles/xsoar_demo_97"

    command_args = {"role_name": role_name}

    result = GCP_IAM.gcp_iam_organization_role_delete_command(client, command_args)

    assert result[0].readable_output == f"Role {role_name} deleted successfully."

    client.gcp_iam_organization_role_delete_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_organization_role_delete_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while trying to delete {role_name}.\n Not Found"


def test_gcp_iam_project_role_delete_command(client):
    """
    Delete a custom project role.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-project-role-delete called.
    Then:
     - Ensure results readable output.
    """
    client.gcp_iam_project_role_delete_request = Mock(return_value={})

    role_name = "projects/xsoar-project-5/roles/test_xsoar_role"

    command_args = {"role_name": role_name}

    result = GCP_IAM.gcp_iam_project_role_delete_command(client, command_args)

    assert result[0].readable_output == f"Role {role_name} deleted successfully."

    client.gcp_iam_project_role_delete_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_project_role_delete_command(client, command_args)
    assert result[0].readable_output == f"An error occurred while trying to delete {role_name}.\n Not Found"


def test_gcp_iam_folder_list_command(client):
    """
    Scenario: list folders.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folders-get called and the user provided the 'parent' argument.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("folder/folder_list.json")
    client.gcp_iam_folder_list_request = Mock(return_value=mock_response)
    parent = "organizations/xsoar-organization"
    result = GCP_IAM.gcp_iam_folders_get_command(client, {"parent": parent})

    assert len(result[0].outputs) == 2
    assert result[0].outputs_prefix == "GCPIAM.Folder"
    assert result[0].outputs[0].get("name") == "folders/folder-name-1"


def test_gcp_iam_folder_get_command(client):
    """
    Scenario: Retrieve folder information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folders-get called and the user not provided the 'parent' argument.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("folder/folder_get.json")
    client.gcp_iam_folder_get_request = Mock(return_value=mock_response)
    folder_name = "folders/folder-name-1"
    result = GCP_IAM.gcp_iam_folders_get_command(client, {"folder_name": folder_name})

    assert len(result[0].outputs) == 1
    assert result[0].outputs_prefix == "GCPIAM.Folder"
    assert result[0].outputs[0].get("name") == folder_name

    client.gcp_iam_folder_get_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_folders_get_command(client, {"folder_name": folder_name})
    assert result[0].readable_output == get_error_message(folder_name)


def test_gcp_iam_folder_iam_policy_get_command(client):
    """
    Scenario: Retrieve the IAM access control policy for the specified folder.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folder-iam-policy-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("folder/folder_iam_policy_get.json")
    client.gcp_iam_folder_iam_policy_get_request = Mock(return_value=mock_response)
    folder_name = "folders/folder-name-1"
    result = GCP_IAM.gcp_iam_folder_iam_policy_get_command(client, {"folder_name": folder_name})

    assert len(result.outputs.get("bindings")) == 2
    assert result.outputs_prefix == "GCPIAM.Policy"
    assert result.outputs.get("name") == folder_name
    assert result.outputs.get("bindings")[0].get("role") == "roles/resourcemanager.folderAdmin"


def test_gcp_iam_folder_iam_test_permission_command(client):
    """
    Scenario: Retrieve permissions that a caller has on the specified folder.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folder-iam-permission-test called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("folder/folder_iam_test_permission.json")
    client.gcp_iam_folder_iam_test_permission_request = Mock(return_value=mock_response)
    folder_name = "folders/folder-name-1"
    permissions = "compute.instances.create,aiplatform.dataItems.create"
    result = GCP_IAM.gcp_iam_folder_iam_test_permission_command(client, {"folder_name": folder_name, "permissions": permissions})

    assert len(result.outputs) == 2
    assert result.outputs_prefix == "GCPIAM.Permission"
    assert result.outputs[1].get("name") == "compute.instances.create"
    assert result.outputs[0].get("name") == "aiplatform.dataItems.create"


def test_gcp_iam_folder_iam_member_add_command(client):
    """
    Scenario: Add members to folder policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folder-iam-member-add called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("folder/folder_iam_policy_set.json")
    client.gcp_iam_folder_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("folder/folder_iam_policy_get.json")
    client.gcp_iam_folder_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    folder_name = "folders/folder-name-1"
    members = "user:user-2@xsoar.com"
    role = "roles/resourcemanager.folderEditor"
    command_args = {"folder_name": folder_name, "role": role, "members": members}

    result = GCP_IAM.gcp_iam_folder_iam_member_add_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_folder_iam_member_remove_command(client):
    """
    Scenario: Remove members from folder policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folder-iam-member-remove called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("folder/folder_iam_policy_set.json")
    client.gcp_iam_folder_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("folder/folder_iam_policy_get.json")
    client.gcp_iam_folder_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    folder_name = "folders/folder-name-1"
    members = "user:user-1@xsoar.com"
    role = "roles/resourcemanager.folderEditor"
    command_args = {"folder_name": folder_name, "role": role, "members": members}

    result = GCP_IAM.gcp_iam_folder_iam_member_remove_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_folder_iam_policy_set_command(client):
    """
    Scenario: Sets the IAM access control folder for the specified project.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folder-iam-policy-set called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("folder/folder_iam_policy_set.json")
    client.gcp_iam_folder_iam_policy_set_request = Mock(return_value=mock_response)

    policy = [
        {"role": "roles/resourcemanager.folderAdmin", "members": ["user:user-1@xsoar.com"]},
        {"role": "roles/resourcemanager.folderEditor", "members": ["user:user-1@xsoar.com", "user:user-2@xsoar.com"]},
    ]

    folder_name = "folders/folder-name-1"

    command_args = {"folder_name": folder_name, "policy": json.dumps(policy)}

    result = GCP_IAM.gcp_iam_folder_iam_policy_set_command(client, command_args)

    assert len(result.outputs.get("bindings")) == 2
    assert result.outputs_prefix == "GCPIAM.Policy"
    assert result.outputs.get("name") == folder_name
    assert result.outputs.get("bindings") == policy


def test_gcp_iam_folder_iam_policy_add_command(client):
    """
    Scenario: Add new folder IAM policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folder-iam-policy-create called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("folder/folder_iam_policy_set.json")
    client.gcp_iam_folder_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("folder/folder_iam_policy_get.json")
    client.gcp_iam_folder_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    folder_name = "folders/folder-name-1"
    role = "roles/resourcemanager.folderEditor"
    members = ["user:user-1@xsoar.com", "user:user-2@xsoar.com"]

    command_args = {"folder_name": folder_name, "role": role, "members": members}

    result = GCP_IAM.gcp_iam_folder_iam_policy_add_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_folder_iam_policy_remove_command(client):
    """
    Scenario: Remove policy from folder IAM policies.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folder-iam-policy-create called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("folder/folder_iam_policy_set.json")
    client.gcp_iam_folder_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("folder/folder_iam_policy_get.json")
    client.gcp_iam_folder_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    folder_name = "folders/folder-name-1"
    role = "roles/resourcemanager.folderEditor"

    command_args = {"folder_name": folder_name, "role": role}

    result = GCP_IAM.gcp_iam_folder_iam_policy_remove_command(client, command_args)

    assert result.readable_output == f"Folder {folder_name} IAM policies updated successfully."


def test_gcp_iam_organization_list_command(client):
    """
    Scenario: list organizations.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organizations-get called and the user not provided the 'organization_name' argument.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("organization/organization_list.json")
    client.gcp_iam_organization_list_request = Mock(return_value=mock_response)

    result = GCP_IAM.gcp_iam_organizations_get_command(client, {})

    assert len(result[0].outputs) == 1
    assert result[0].outputs_prefix == "GCPIAM.Organization"
    assert result[0].outputs[0].get("name") == "organizations/xsoar-organization"


def test_gcp_iam_organization_get_command(client):
    """
    Scenario: Retrieve folder information.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-folders-get called and the user not provided the 'parent' argument.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("organization/organization_get.json")
    client.gcp_iam_organization_get_request = Mock(return_value=mock_response)
    organization_name = "organizations/xsoar-organization"
    result = GCP_IAM.gcp_iam_organizations_get_command(client, {"organization_name": organization_name})

    assert len(result[0].outputs) == 1
    assert result[0].outputs_prefix == "GCPIAM.Organization"
    assert result[0].outputs[0].get("name") == organization_name

    client.gcp_iam_organization_get_request.side_effect = Exception("Not Found")
    result = GCP_IAM.gcp_iam_organizations_get_command(client, {"organization_name": organization_name})
    assert result[0].readable_output == get_error_message(organization_name)


def test_gcp_iam_organization_iam_policy_get_command(client):
    """
    Scenario: Retrieve the IAM access control policy for the specified organization.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-iam-policy-get called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("organization/organization_iam_policy_get.json")
    client.gcp_iam_organization_iam_policy_get_request = Mock(return_value=mock_response)
    organization_name = "organizations/xsoar-organization"
    result = GCP_IAM.gcp_iam_organization_iam_policy_get_command(client, {"organization_name": organization_name})

    assert len(result.outputs.get("bindings")) == 2
    assert result.outputs_prefix == "GCPIAM.Policy"
    assert result.outputs.get("name") == organization_name
    assert result.outputs.get("bindings")[0].get("role") == "roles/bigquery.admin"


def test_gcp_iam_organization_iam_test_permission_command(client):
    """
    Scenario: Retrieve permissions that a caller has on the specified organization.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-iam-permission-test called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("organization/organization_iam_test_permission.json")
    client.gcp_iam_organization_iam_test_permission_request = Mock(return_value=mock_response)
    organization_name = "organizations/xsoar-organization"
    permissions = "compute.instances.create,aiplatform.dataItems.create"
    result = GCP_IAM.gcp_iam_organization_iam_test_permission_command(
        client, {"organization_name": organization_name, "permissions": permissions}
    )

    assert len(result.outputs) == 2
    assert result.outputs_prefix == "GCPIAM.Permission"
    assert result.outputs[1].get("name") == "compute.instances.create"
    assert result.outputs[0].get("name") == "aiplatform.dataItems.create"


def test_gcp_iam_organization_iam_member_add_command(client):
    """
    Scenario: Add members to organization policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-iam-member-add called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("organization/organization_iam_policy_set.json")
    client.gcp_iam_organization_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("organization/organization_iam_policy_get.json")
    client.gcp_iam_organization_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    organization_name = "organizations/xsoar-organization"
    members = "user:user-2@xsoar.com"
    role = "roles/bigquery.user"
    command_args = {"organization_name": organization_name, "role": role, "members": members}

    result = GCP_IAM.gcp_iam_organization_iam_member_add_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_organization_iam_member_remove_command(client):
    """
    Scenario: Remove members from organization policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-iam-member-remove called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("organization/organization_iam_policy_set.json")
    client.gcp_iam_organization_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("organization/organization_iam_policy_get.json")
    client.gcp_iam_organization_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    organization_name = "organizations/xsoar-organization"
    members = "user:user-1@xsoar.com"
    role = "roles/bigquery.user"
    command_args = {"organization_name": organization_name, "role": role, "members": members}

    result = GCP_IAM.gcp_iam_organization_iam_member_remove_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_organization_iam_policy_set_command(client):
    """
    Scenario: Sets the IAM access control folder for the specified organization.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-iam-policy-set called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_response = load_mock_response("organization/organization_iam_policy_set.json")
    client.gcp_iam_organization_iam_policy_set_request = Mock(return_value=mock_response)

    policy = [
        {"role": "roles/bigquery.admin", "members": ["user:user-1@xsoar.com"]},
        {"role": "roles/bigquery.user", "members": ["user:user-1@xsoar.com", "user:user-2@xsoar.com"]},
    ]

    organization_name = "organizations/xsoar-organization"

    command_args = {"organization_name": organization_name, "policy": json.dumps(policy)}

    result = GCP_IAM.gcp_iam_organization_iam_policy_set_command(client, command_args)

    assert len(result.outputs.get("bindings")) == 2
    assert result.outputs_prefix == "GCPIAM.Policy"
    assert result.outputs.get("name") == organization_name
    assert result.outputs.get("bindings") == policy


def test_gcp_iam_organization_iam_policy_add_command(client):
    """
    Scenario: Add new organization IAM policy.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-iam-policy-create called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("organization/organization_iam_policy_set.json")
    client.gcp_iam_organization_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("organization/organization_iam_policy_get.json")
    client.gcp_iam_organization_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    organization_name = "organizations/xsoar-organization"
    role = "roles/bigquery.user"
    members = ["user:user-1@xsoar.com", "user:user-2@xsoar.com"]

    command_args = {"organization_name": organization_name, "role": role, "members": members}

    result = GCP_IAM.gcp_iam_organization_iam_policy_add_command(client, command_args)

    assert result.readable_output == f"Role {role} updated successfully."


def test_gcp_iam_organization_iam_policy_remove_command(client):
    """
    Scenario: Remove policy from organization IAM policies.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-organization-iam-policy-remove called.
    Then:
     - Ensure results readable output.
    """
    mock_response = load_mock_response("organization/organization_iam_policy_set.json")
    client.gcp_iam_organization_iam_policy_set_request = Mock(return_value=mock_response)

    iam_get_mock_response = load_mock_response("organization/organization_iam_policy_get.json")
    client.gcp_iam_organization_iam_policy_get_request = Mock(return_value=iam_get_mock_response)

    organization_name = "organizations/xsoar-organization"
    role = "roles/bigquery.user"

    command_args = {"organization_name": organization_name, "role": role}

    result = GCP_IAM.gcp_iam_organization_iam_policy_remove_command(client, command_args)

    assert result.readable_output == f"Organization {organization_name} IAM policies updated successfully."


def test_gcp_iam_tagbindings_list_command(client):
    """
    Scenario: list tagbindings.
    Given:
     - User has provided valid credentials.
    When:
     - gcp-iam-tagbindings-list command called.
    Then:
     - Ensure number of items is correct.
     - Ensure outputs prefix is correct.
     - Ensure a sample value from the API matches what is generated in the context.
    """
    mock_binding = load_mock_response("tag_bindings/tag_bindings.json")
    client.gcp_iam_tagbindings_list_request = Mock(return_value=mock_binding)

    mock_keys = load_mock_response("tag_bindings/tag_keys.json")
    client.gcp_iam_tagkeys_get_request = Mock(return_value=mock_keys)

    mock_values = load_mock_response("tag_bindings/tag_values.json")
    client.gcp_iam_tagvalues_get_request = Mock(return_value=mock_values)

    parent = "folder/111111111111"
    result = GCP_IAM.gcp_iam_tagbindings_list_command(client, {"parent": parent})

    assert len(result.outputs) == 1
    assert result.outputs_prefix == "GCPIAM.TagBindings"
    assert result.outputs == [{"key": "environment", "value": "non-production"}]