from __future__ import annotations

import unittest

from govoplan_core.core.access import PrincipalRef
from govoplan_policy.backend.access_explanation_subjects import (
    ACCESS_EXPLANATION_SUBJECT_SCOPE,
    AccessExplanationSubjectPolicyProvider,
)


class AccessExplanationSubjectPolicyTests(unittest.TestCase):
    def setUp(self) -> None:
        self.provider = AccessExplanationSubjectPolicyProvider()

    def test_defaults_to_current_user_without_permission(self) -> None:
        decision = self.provider.decide_subject_selection(
            object(),
            PrincipalRef(
                account_id="account-1",
                membership_id="user-1",
                tenant_id="tenant-1",
            ),
            tenant_id="tenant-1",
        )

        self.assertFalse(decision.allow_other_users)
        self.assertEqual(ACCESS_EXPLANATION_SUBJECT_SCOPE, decision.required_scope)
        self.assertEqual("current_user", decision.provenance["mode"])

    def test_permission_enables_cross_user_diagnostics(self) -> None:
        decision = self.provider.decide_subject_selection(
            object(),
            PrincipalRef(
                account_id="account-1",
                membership_id="user-1",
                tenant_id="tenant-1",
                scopes=frozenset({ACCESS_EXPLANATION_SUBJECT_SCOPE}),
            ),
            tenant_id="tenant-1",
        )

        self.assertTrue(decision.allow_other_users)
        self.assertEqual("cross_user", decision.provenance["mode"])

    def test_never_crosses_the_active_tenant(self) -> None:
        decision = self.provider.decide_subject_selection(
            object(),
            PrincipalRef(
                account_id="account-1",
                membership_id="user-1",
                tenant_id="tenant-1",
                scopes=frozenset({ACCESS_EXPLANATION_SUBJECT_SCOPE}),
            ),
            tenant_id="tenant-2",
        )

        self.assertFalse(decision.allow_other_users)
        self.assertEqual("policy.tenant_boundary", decision.source)


if __name__ == "__main__":
    unittest.main()