"""Registration and first system-admin tests."""

from __future__ import annotations

import uuid

from auth import AUTH_HEADER, get_session
from db import get_connection
from services.registration import user_count


def test_setup_status_open_without_users(client):
    if user_count() > 0:
        return
    res = client.get("/api/auth/setup-status")
    assert res.status_code == 200
    body = res.json()
    assert body["registration_open"] is True
    assert body["has_users"] is False


def test_register_first_user_becomes_portal_admin(client):
    if user_count() > 0:
        return

    suffix = uuid.uuid4().hex[:8]
    email = f"admin-{suffix}@example.com"
    res = client.post(
        "/api/auth/register",
        json={
            "email": email,
            "password": "secure-pass-123",
            "display_name": "System Admin",
            "organization_name": "Kairo Org",
        },
    )
    assert res.status_code == 200, res.text
    body = res.json()
    assert body["user"]["portal_role"] == "admin"
    assert body["token"]
    assert get_session(body["token"]) is not None

    me = client.get("/api/me", headers={AUTH_HEADER: body["token"]})
    assert me.status_code == 200
    assert me.json()["portal_role"] == "admin"

    ctx = client.get("/api/me/context", headers={AUTH_HEADER: body["token"]})
    assert ctx.status_code == 200
    assert ctx.json()["tenant"]["role"] == "owner"
    assert ctx.json()["actor"]["type"] == "human"

    # cleanup: allow re-run in isolated env — skip delete in shared CI DB
    closed = client.get("/api/auth/setup-status")
    assert closed.json()["registration_open"] is False


def test_register_closed_when_users_exist(client):
    if user_count() == 0:
        return

    res = client.post(
        "/api/auth/register",
        json={
            "email": f"other-{uuid.uuid4().hex[:8]}@example.com",
            "password": "secure-pass-123",
            "display_name": "Other User",
        },
    )
    assert res.status_code == 403