"""Request-scoped tenant context (ADR #015) over the authz mini-graph:
membership is engagement-derived, super admins see all tenants (default
first), and the `with_tenant` cookie selects the current one. Supersedes
ADR #004 #13's "tenant is a setting" — no code path reads app_tenant_slug
as a hard pin any more."""

from __future__ import annotations

from app.services.authz.context import allowed_tenants
from tests.authz.conftest import actor_for


def _slugs(graph, username):
    actor = actor_for(graph, username)
    return [t.slug for t in actor.allowed_tenants]


def test_super_admin_sees_every_tenant_default_first(graph):
    # The mini-graph has Bowden Works + an empty Tingang tenant.
    assert _slugs(graph, "rian") == ["bowden-works", "tingang"]


def test_manager_and_worker_see_only_their_engaged_tenant(graph):
    assert _slugs(graph, "adi") == ["bowden-works"]
    assert _slugs(graph, "gary") == ["bowden-works"]


def test_user_without_a_party_has_no_tenants(graph):
    assert _slugs(graph, "mallory") == []
    actor = actor_for(graph, "mallory")
    assert actor.tenant_id is None


def test_default_tenant_is_first_allowed_without_a_cookie(graph):
    actor = actor_for(graph, "rian")
    assert actor.tenant_name == "Bowden Works"
    assert actor.tenant_slug == "bowden-works"


def test_cookie_switches_current_tenant_within_allowed_set(graph):
    actor = actor_for(graph, "rian", cookies={"with_tenant": "tingang"})
    assert actor.tenant_slug == "tingang"
    assert actor.tenant_name == "Tingang"


def test_forbidden_cookie_is_ignored_and_falls_back(graph):
    # adi is only a Bowden Works member; a Tingang cookie is ignored.
    actor = actor_for(graph, "adi", cookies={"with_tenant": "tingang"})
    assert actor.tenant_slug == "bowden-works"


def test_allowed_tenants_helper_matches_actor(graph):
    adi = actor_for(graph, "adi")
    helper = allowed_tenants(graph.session, adi.person_party_id, False)
    assert [t.slug for t in helper] == [t.slug for t in adi.allowed_tenants]