"""Capability resolution and require_capability tests."""

from __future__ import annotations

from auth import AUTH_HEADER
from tests.factories import provision_user_in_tenant


@pytest.fixture()
def enforce_capabilities(monkeypatch):
    monkeypatch.setenv("CAPABILITY_ENFORCE", "enforce")


def test_portal_admin_has_admin_capability(client, enforce_capabilities):
    admin = provision_user_in_tenant(tenant_role="member", portal_role="admin")
    login = client.post(
        "/api/auth/login",
        json={"email": admin["email"], "password": admin["password"]},
    )
    token = login.json()["token"]

    res = client.get("/api/me/admin/demo", headers={AUTH_HEADER: token})
    assert res.status_code == 200
    assert res.json()["ok"] is True


def test_tenant_member_denied_admin_capability(client, enforce_capabilities):
    member = provision_user_in_tenant(tenant_role="member", portal_role="user")
    login = client.post(
        "/api/auth/login",
        json={"email": member["email"], "password": member["password"]},
    )
    token = login.json()["token"]

    res = client.get("/api/me/admin/demo", headers={AUTH_HEADER: token})
    assert res.status_code == 403


def test_tenant_owner_has_manage_capabilities(client, enforce_capabilities):
    owner = provision_user_in_tenant(tenant_role="owner", portal_role="user")
    login = client.post(
        "/api/auth/login",
        json={"email": owner["email"], "password": owner["password"]},
    )
    token = login.json()["token"]
    ctx = client.get("/api/me/context", headers={AUTH_HEADER: token}).json()

    assert "kairo.tenant.manage" in ctx["capabilities"]
    assert "kairo.actor.manage" in ctx["capabilities"]
    assert "kairo.admin.access" not in ctx["capabilities"]


def test_probe_mode_allows_without_capability(client, monkeypatch):
    monkeypatch.setenv("CAPABILITY_ENFORCE", "probe")
    member = provision_user_in_tenant(tenant_role="member", portal_role="user")
    login = client.post(
        "/api/auth/login",
        json={"email": member["email"], "password": member["password"]},
    )
    token = login.json()["token"]

    res = client.get("/api/me/admin/demo", headers={AUTH_HEADER: token})
    assert res.status_code == 200