"""resolve_actor: session identity -> users row -> engagement-derived
role + capability set; view-as as an app-layer context swap (T-AZ-030),
with forged/stale impersonation state silently ignored (T-VAS-01)."""

from tests.authz.conftest import actor_for


def test_rian_resolves_owner_super_admin(graph):
    actor = actor_for(graph, "rian")
    assert actor.role == "owner"
    assert actor.real_is_super_admin and actor.is_super_admin
    assert actor.tenant_name == "Bowden Works"
    assert actor.role_reason.startswith("official_partnership#")
    assert all(actor.capabilities.values())  # A1: everything


def test_adi_resolves_manager(graph):
    actor = actor_for(graph, "adi")
    assert actor.role == "manager"
    assert "can_manage_imports" in actor.role_reason
    assert actor.allowed("can_manage_imports")
    assert not actor.allowed("can_transfer")
    assert not actor.allowed("can_see_income")
    assert not actor.allowed("can_enter_view_as")


def test_gary_resolves_worker(graph):
    actor = actor_for(graph, "gary")
    assert actor.role == "worker"
    assert not any(actor.capabilities.values())


def test_mallory_has_no_party_no_role(graph):
    actor = actor_for(graph, "mallory")
    assert actor.role == "none"
    assert not any(actor.capabilities.values())


def test_unknown_username_resolves_zero_capability(graph):
    actor = actor_for(graph, "stranger")
    assert actor.user_id is None
    assert actor.role == "none"
    assert not any(actor.capabilities.values())


def test_t_az_030_view_as_is_a_context_swap(graph):
    actor = actor_for(graph, "rian", cookies={"with_view_as": "adi"})
    assert actor.is_viewing_as
    assert actor.username == "adi" and actor.real_username == "rian"
    assert actor.user_id == graph.users["adi"].id
    assert actor.real_user_id == graph.users["rian"].id
    assert actor.view_as_label == "Adi Pramono"  # person party name
    assert actor.role == "manager"
    # manager capabilities, super-admin power stripped, no nesting
    assert actor.allowed("can_manage_imports")
    assert not actor.allowed("can_transfer")
    assert not actor.allowed("can_enter_view_as")


def test_t_vas_01_forged_cookie_by_non_super_admin_ignored(graph):
    actor = actor_for(graph, "adi", cookies={"with_view_as": "rian"})
    assert not actor.is_viewing_as
    assert actor.username == "adi"
    assert not actor.allowed("can_transfer")


def test_stale_cookie_with_missing_target_falls_back_to_real(graph):
    actor = actor_for(graph, "rian", cookies={"with_view_as": "ghost"})
    assert not actor.is_viewing_as
    assert actor.username == "rian"


def test_self_targeting_cookie_is_a_noop(graph):
    actor = actor_for(graph, "rian", cookies={"with_view_as": "rian"})
    assert not actor.is_viewing_as
    assert actor.allowed("can_enter_view_as")