"""Multi-user UI auth and RBAC."""

from app.models.user import USER_ROLE_MONITOR


def test_login_success(client):
    response = client.post(
        "/api/v1/auth/login",
        json={"username": "test-admin", "password": "test-admin-password"},
    )
    assert response.status_code == 200
    body = response.json()
    assert body["username"] == "test-admin"
    assert body["role"] == "admin"
    assert body["access_token"]


def test_login_monitor(client):
    response = client.post(
        "/api/v1/auth/login",
        json={"username": "test-monitor", "password": "test-monitor-password"},
    )
    assert response.status_code == 200
    assert response.json()["role"] == USER_ROLE_MONITOR


def test_login_invalid_password(client):
    response = client.post(
        "/api/v1/auth/login",
        json={"username": "test-admin", "password": "wrong"},
    )
    assert response.status_code == 401


def test_auth_me(client, jwt_headers):
    response = client.get("/api/v1/auth/me", headers=jwt_headers)
    assert response.status_code == 200
    assert response.json() == {"username": "test-admin", "role": "admin"}


def test_settings_forbidden_for_monitor(client, jwt_monitor_headers):
    response = client.get("/api/v1/settings/notifications", headers=jwt_monitor_headers)
    assert response.status_code == 403


def test_events_allowed_for_monitor(client, jwt_monitor_headers):
    response = client.get("/api/v1/events", headers=jwt_monitor_headers)
    assert response.status_code == 200


def test_admin_create_monitor_user(client, jwt_headers):
    response = client.post(
        "/api/v1/users",
        headers=jwt_headers,
        json={"username": "new-monitor", "password": "longpassword1", "role": "monitor"},
    )
    assert response.status_code == 201
    assert response.json()["username"] == "new-monitor"
    assert response.json()["role"] == "monitor"


def test_monitor_cannot_list_users(client, jwt_monitor_headers):
    response = client.get("/api/v1/users", headers=jwt_monitor_headers)
    assert response.status_code == 403