"""T-AZ-043 — the AUTH_DEV_USER stub (judgment #13): a local-test
convenience that hard-refuses production-flagged environments."""

import pytest
from fastapi.testclient import TestClient

from app.main import create_app


def test_t_az_043_stub_refuses_production(monkeypatch):
    monkeypatch.setenv("APP_ENV", "production")
    monkeypatch.setenv("AUTH_DEV_USER", "rian")
    with pytest.raises(RuntimeError, match="AUTH_DEV_USER"):
        create_app()


def test_t_az_043_production_without_stub_starts(monkeypatch):
    monkeypatch.setenv("APP_ENV", "production")
    monkeypatch.delenv("AUTH_DEV_USER", raising=False)
    assert create_app() is not None


def test_t_az_043_stub_resolves_identity_in_dev(monkeypatch, db_engine):
    monkeypatch.setenv("APP_ENV", "development")
    monkeypatch.setenv("AUTH_DEV_USER", "devuser")
    with TestClient(create_app(), base_url="https://testserver") as client:
        resp = client.get("/api/me")  # no session cookie at all
        assert resp.status_code == 200
        body = resp.json()
        assert body["username"] == "devuser"
        assert body["is_super_admin"] is False  # stub identity has zero capabilities
        assert not any(body["capabilities"].values())


def test_t_az_043_no_stub_means_no_identity(client):
    # The suite's env (APP_ENV=test, no AUTH_DEV_USER) must not leak identity.
    assert client.get("/api/me").status_code == 401