"""Membership derivation (ADR #015): allowed tenants = engagement-derived
role-bearing tenants (owner/manager/worker) PLUS every tenant for super
admins; ended engagements grant nothing; super admins see all, default
tenant first. Also the request-scoped current-tenant cookie resolution."""

from __future__ import annotations

from sqlalchemy import select

from app.models import User
from app.services.authz.context import allowed_tenants, resolve_actor
from tests.authz.conftest import fake_request


def _slugs(session, username: str) -> list[str]:
    user = session.scalar(select(User).where(User.idauth_username == username))
    is_sa = bool(user.is_super_admin)
    return [t.slug for t in allowed_tenants(session, user.person_party_id, is_sa)]


def test_super_admin_sees_all_tenants_default_first(session):
    # rian is super admin: both books, bowden-works (default slug) first.
    assert _slugs(session, "rian") == ["bowden-works", "plusroi"]


def test_owner_engagement_grants_only_its_tenant(session):
    assert _slugs(session, "alice") == ["bowden-works"]
    assert _slugs(session, "bob") == ["plusroi"]


def test_worker_engagement_grants_membership(session):
    # carol is a plain subcontract (worker) on B — still a member.
    assert _slugs(session, "carol") == ["plusroi"]


def test_ended_engagement_grants_no_membership(session):
    # alice ALSO has an ENDED official_partnership on B — it must not count.
    assert "plusroi" not in _slugs(session, "alice")


def test_user_with_no_engagement_has_no_tenants(session):
    assert _slugs(session, "nobody") == []


def test_cookie_selects_current_tenant_for_super_admin(session):
    # No cookie -> default (first allowed) tenant.
    actor = resolve_actor(fake_request("rian"), session)
    assert actor.tenant_slug == "bowden-works"
    # A cookie in the allowed set switches the current tenant.
    switched = resolve_actor(
        fake_request("rian", cookies={"with_tenant": "plusroi"}), session
    )
    assert switched.tenant_slug == "plusroi"
    assert switched.tenant_name == "PlusROI"


def test_forbidden_cookie_falls_back_to_first_allowed(session):
    # bob may only see plusroi; a cookie pointing at A is ignored.
    actor = resolve_actor(
        fake_request("bob", cookies={"with_tenant": "bowden-works"}), session
    )
    assert actor.tenant_slug == "plusroi"


def test_stale_cookie_at_unknown_tenant_falls_back(session):
    actor = resolve_actor(
        fake_request("bob", cookies={"with_tenant": "since-deleted"}), session
    )
    assert actor.tenant_slug == "plusroi"


def test_no_tenant_actor_has_none(session):
    actor = resolve_actor(fake_request("nobody"), session)
    assert actor.tenant_id is None
    assert actor.tenant_slug is None
    assert actor.role == "none"