"""Entitlements snapshot tests."""

from __future__ import annotations

from auth import AUTH_HEADER
from tests.factories import provision_user_in_tenant


def test_entitlements_snapshot_shape(client):
    user = provision_user_in_tenant(tenant_role="owner", portal_role="admin")
    login = client.post(
        "/api/auth/login",
        json={"email": user["email"], "password": user["password"]},
    )
    token = login.json()["token"]

    res = client.get("/api/me/entitlements", headers={AUTH_HEADER: token})
    assert res.status_code == 200
    body = res.json()

    assert "account" in body
    assert body["account"]["portal_role"] == "admin"
    assert "capabilities" in body["account"]
    assert body["tenant"]["tenant_id"] == user["tenant_id"]
    assert body["actor"]["actor_id"] == user["actor_id"]
    assert body["roles"]["portal"] == "admin"
    assert body["roles"]["tenant"] == "owner"
    assert "kairo.admin.access" in body["capabilities"]
    assert body["enforcement"]["capabilities"] in ("probe", "enforce")
    assert body["enforcement"]["features"] == "probe"
    assert body["features"] == {}