"""Workspaces und Mandantentrennung (→ Konzept 6.2, 15: fremde Workspaces nicht abrufbar)."""

from helpers import connect_repo, create_workspace


def test_workspace_anlegen_macht_ersteller_zum_admin(browser, people):
    anna = browser("anna")
    workspace_id = create_workspace(anna, people["team_demo"])
    page = anna.get(f"/workspaces/{workspace_id}")
    assert page.status_code == 200
    assert "Admin" in page.text and "Projekt X" in page.text


def test_nur_fuer_eigene_teams(browser, people):
    response = browser("anna").post("/workspaces", {"team_id": people["team_other"], "name": "Fremd"})
    assert response.status_code == 400
    assert "eigene Teams" in response.text


def test_fremder_workspace_ist_404(browser, people):
    workspace_id = create_workspace(browser("anna"), people["team_demo"])
    # dora ist in einem anderen Team, ben im selben Team, aber kein Mitglied
    for username in ("dora", "ben"):
        assert browser(username).get(f"/workspaces/{workspace_id}").status_code == 404


def test_globaler_admin_sieht_fremde_workspaces_nicht(browser, people, db):
    from app.identity.models import User
    with db.session() as session:
        session.get(User, people["dora"]).is_admin = True
    workspace_id = create_workspace(browser("anna"), people["team_demo"])
    assert browser("dora").get(f"/workspaces/{workspace_id}").status_code == 404


def test_mitglied_hinzufuegen_nur_aus_dem_team(browser, people):
    anna = browser("anna")
    workspace_id = create_workspace(anna, people["team_demo"])
    assert anna.post(f"/workspaces/{workspace_id}/members", {"username": "ben", "role": "member"}).status_code == 303
    assert browser("ben").get(f"/workspaces/{workspace_id}").status_code == 200
    response = anna.post(f"/workspaces/{workspace_id}/members", {"username": "dora", "role": "member"})
    assert response.status_code == 400


def test_mitglied_darf_nicht_verwalten(browser, people, git_repo):
    anna = browser("anna")
    workspace_id = create_workspace(anna, people["team_demo"])
    anna.post(f"/workspaces/{workspace_id}/members", {"username": "ben", "role": "member"})
    ben = browser("ben")
    assert ben.post(f"/workspaces/{workspace_id}/members", {"username": "clara", "role": "admin"}).status_code == 403
    response = ben.post(f"/workspaces/{workspace_id}/sources",
                        {"name": "R", "url": git_repo, "exposure_confirmed": "1"})
    assert response.status_code == 403


def test_letzter_admin_bleibt(browser, people):
    anna = browser("anna")
    workspace_id = create_workspace(anna, people["team_demo"])
    response = anna.post(f"/workspaces/{workspace_id}/members", {"username": "anna", "role": "member"})
    assert response.status_code == 400


def test_audit_eintraege(browser, people, db, git_repo):
    from sqlalchemy import select

    from app.audit.models import AuditEvent
    anna = browser("anna")
    workspace_id = create_workspace(anna, people["team_demo"])
    connect_repo(anna, workspace_id, git_repo)
    with db.session() as session:
        actions = set(session.scalars(select(AuditEvent.action)))
    assert {"auth.login", "workspace.created", "source.created", "source.exposure_confirmed",
            "source.tested"} <= actions