"""Multi-user UI auth and RBAC."""

from app.models.user import USER_ROLE_MONITOR


def test_login_success(client):
    response = client.post(
        "/api/v1/auth/login",
        json={"username": "test-admin", "password": "test-admin-password"},
    )
    assert response.status_code == 200
    body = response.json()
    assert body["username"] == "test-admin"
    assert body["role"] == "admin"
    assert body["access_token"]


def test_login_monitor(client):
    response = client.post(
        "/api/v1/auth/login",
        json={"username": "test-monitor", "password": "test-monitor-password"},
    )
    assert response.status_code == 200
    assert response.json()["role"] == USER_ROLE_MONITOR


def test_login_invalid_password(client):
    response = client.post(
        "/api/v1/auth/login",
        json={"username": "test-admin", "password": "wrong"},
    )
    assert response.status_code == 401


def test_auth_me(client, jwt_headers):
    response = client.get("/api/v1/auth/me", headers=jwt_headers)
    assert response.status_code == 200
    assert response.json() == {"username": "test-admin", "role": "admin"}


def test_settings_forbidden_for_monitor(client, jwt_monitor_headers):
    response = client.get("/api/v1/settings/notifications", headers=jwt_monitor_headers)
    assert response.status_code == 403


def test_events_allowed_for_monitor(client, jwt_monitor_headers):
    response = client.get("/api/v1/events", headers=jwt_monitor_headers)
    assert response.status_code == 200


def test_admin_create_monitor_user(client, jwt_headers):
    response = client.post(
        "/api/v1/users",
        headers=jwt_headers,
        json={"username": "new-monitor", "password": "longpassword1", "role": "monitor"},
    )
    assert response.status_code == 201
    assert response.json()["username"] == "new-monitor"
    assert response.json()["role"] == "monitor"


def test_monitor_cannot_list_users(client, jwt_monitor_headers):
    response = client.get("/api/v1/users", headers=jwt_monitor_headers)
    assert response.status_code == 403


def test_admin_update_user_role_and_password(client, jwt_headers):
    create = client.post(
        "/api/v1/users",
        headers=jwt_headers,
        json={"username": "patch-me", "password": "longpassword1", "role": "monitor"},
    )
    assert create.status_code == 201
    user_id = create.json()["id"]

    response = client.patch(
        f"/api/v1/users/{user_id}",
        headers=jwt_headers,
        json={"role": "admin", "password": "newpassword9"},
    )
    assert response.status_code == 200
    body = response.json()
    assert body["role"] == "admin"

    login = client.post(
        "/api/v1/auth/login",
        json={"username": "patch-me", "password": "newpassword9"},
    )
    assert login.status_code == 200
    assert login.json()["role"] == "admin"


def test_admin_update_username(client, jwt_headers):
    create = client.post(
        "/api/v1/users",
        headers=jwt_headers,
        json={"username": "old-name", "password": "longpassword1", "role": "monitor"},
    )
    user_id = create.json()["id"]

    response = client.patch(
        f"/api/v1/users/{user_id}",
        headers=jwt_headers,
        json={"username": "new-name"},
    )
    assert response.status_code == 200
    assert response.json()["username"] == "new-name"

    login = client.post(
        "/api/v1/auth/login",
        json={"username": "new-name", "password": "longpassword1"},
    )
    assert login.status_code == 200


def test_admin_deactivate_user(client, jwt_headers):
    create = client.post(
        "/api/v1/users",
        headers=jwt_headers,
        json={"username": "to-disable", "password": "longpassword1", "role": "monitor"},
    )
    user_id = create.json()["id"]

    response = client.patch(
        f"/api/v1/users/{user_id}",
        headers=jwt_headers,
        json={"is_active": False},
    )
    assert response.status_code == 200
    assert response.json()["is_active"] is False

    login = client.post(
        "/api/v1/auth/login",
        json={"username": "to-disable", "password": "longpassword1"},
    )
    assert login.status_code == 401