"""T-AZ-001 — the R1 parity grid (06-test-plan §4.1), evaluated through
capabilities.py as one parametrized sweep. The expected values are the
current app's EFFECTIVE enforcement, verbatim from rpcs-and-authz §5 —
including can_manage_team pinned to the effective rule (owner/super
admin), NOT the dead canManageTeam function's any-manager grant.

Also T-PRM-02 (no actor => everything False) and T-PRM-03 (super-admin
power stripped while viewing-as, even viewing-as another super admin).
"""

import pytest

from app.services.authz.capabilities import (
    CAPABILITIES,
    capability_allowed,
    edit_entry_capability,
)

# (actor fixture id, role, is_super_admin, is_viewing_as)
ACTORS = {
    "A1-rian-super-admin": ("owner", True, False),
    "A2-owner": ("owner", False, False),
    "A3-manager": ("manager", False, False),
    "A4-worker": ("worker", False, False),
    "A5-no-engagement": ("none", False, False),
    "A6a-viewing-as-owner": ("owner", False, True),
    "A6b-viewing-as-manager": ("manager", False, True),
    "A6c-viewing-as-worker": ("worker", False, True),
    "A7-viewing-as-super-admin-owner": ("owner", True, True),
}

# capability -> expected per actor fixture (grid columns from §4.1)
EXPECTED = {
    "can_transfer": {
        "A1-rian-super-admin": True,
        "A2-owner": True,
        "A3-manager": False,
        "A4-worker": False,
        "A5-no-engagement": False,
        "A6a-viewing-as-owner": True,
        "A6b-viewing-as-manager": False,
        "A6c-viewing-as-worker": False,
        # super-admin power stripped: target role (owner) wins
        "A7-viewing-as-super-admin-owner": True,
    },
    "can_see_income": {},  # = can_transfer wiring, filled below
    "can_manage_imports": {
        "A1-rian-super-admin": True,
        "A2-owner": True,
        "A3-manager": True,
        "A4-worker": False,
        "A5-no-engagement": False,
        "A6a-viewing-as-owner": True,
        "A6b-viewing-as-manager": True,
        "A6c-viewing-as-worker": False,
        "A7-viewing-as-super-admin-owner": True,
    },
    "can_manage_team": {
        "A1-rian-super-admin": True,
        "A2-owner": True,
        "A3-manager": False,  # the EFFECTIVE rule, not dead canManageTeam
        "A4-worker": False,
        "A5-no-engagement": False,
        "A6a-viewing-as-owner": True,
        "A6b-viewing-as-manager": False,
        "A6c-viewing-as-worker": False,
        "A7-viewing-as-super-admin-owner": True,
    },
    "can_enter_view_as": {
        "A1-rian-super-admin": True,
        "A2-owner": False,
        "A3-manager": False,
        "A4-worker": False,
        "A5-no-engagement": False,
        "A6a-viewing-as-owner": False,  # no nesting
        "A6b-viewing-as-manager": False,
        "A6c-viewing-as-worker": False,
        "A7-viewing-as-super-admin-owner": False,
    },
}
EXPECTED["can_see_income"] = dict(EXPECTED["can_transfer"])

GRID = [
    (actor_id, capability)
    for capability in EXPECTED
    for actor_id in ACTORS
]


@pytest.mark.parametrize(("actor_id", "capability"), GRID)
def test_t_az_001_grid(actor_id, capability):
    role, is_sa, viewing = ACTORS[actor_id]
    assert (
        capability_allowed(
            capability, role=role, is_super_admin=is_sa, is_viewing_as=viewing
        )
        is EXPECTED[capability][actor_id]
    ), f"{actor_id} × {capability}"


@pytest.mark.parametrize("actor_id", list(ACTORS))
@pytest.mark.parametrize("locked", [False, True])
def test_t_az_001_can_edit_entry(actor_id, locked):
    """canEditEntry(locked) = canTransfer; (unlocked) = canManageImports."""
    role, is_sa, viewing = ACTORS[actor_id]
    gate = edit_entry_capability(locked)
    assert gate == ("can_transfer" if locked else "can_manage_imports")
    expected = EXPECTED[gate][actor_id]
    assert (
        capability_allowed(gate, role=role, is_super_admin=is_sa, is_viewing_as=viewing)
        is expected
    )


def test_t_prm_02_no_actor_means_no_capability():
    """A0: no resolvable actor -> role 'none', not super admin -> every
    capability False."""
    for capability in CAPABILITIES:
        assert not capability_allowed(
            capability, role="none", is_super_admin=False, is_viewing_as=False
        )


def test_t_prm_03_super_admin_power_stripped_while_viewing_as():
    """Viewing-as a super-admin with NO tenant role: nothing granted —
    only the target's derived role counts."""
    for capability in CAPABILITIES:
        assert not capability_allowed(
            capability, role="none", is_super_admin=True, is_viewing_as=True
        )