from __future__ import annotations

import unittest

from fastapi import HTTPException

from govoplan_core.auth import ApiPrincipal
from govoplan_core.core.access import PrincipalRef
from govoplan_views.backend.router import (
    _require_definition_read,
    _require_definition_write,
)


def principal(
    *,
    account_id: str = "account-1",
    scopes: tuple[str, ...],
    group_ids: tuple[str, ...] = (),
) -> ApiPrincipal:
    return ApiPrincipal(
        principal=PrincipalRef(
            account_id=account_id,
            membership_id="membership-1",
            tenant_id="tenant-1",
            scopes=frozenset(scopes),
            group_ids=frozenset(group_ids),
        ),
        account=object(),
        user=object(),
    )


class ViewDefinitionAuthorizationTests(unittest.TestCase):
    def test_personal_writer_cannot_edit_another_accounts_view(self) -> None:
        actor = principal(scopes=("views:personal_definition:write",))

        _require_definition_write(actor, "user", "account-1")
        with self.assertRaises(HTTPException) as caught:
            _require_definition_write(actor, "user", "account-2")

        self.assertEqual(403, caught.exception.status_code)

    def test_group_reader_is_limited_to_current_memberships(self) -> None:
        actor = principal(
            scopes=("views:group_definition:read",),
            group_ids=("group-1",),
        )

        _require_definition_read(actor, "group", "group-1")
        with self.assertRaises(HTTPException) as caught:
            _require_definition_read(actor, "group", "group-2")

        self.assertEqual(403, caught.exception.status_code)

    def test_tenant_manager_can_manage_owned_views(self) -> None:
        actor = principal(scopes=("views:definition:write",))

        _require_definition_write(actor, "group", "group-2")
        _require_definition_write(actor, "user", "account-2")


if __name__ == "__main__":
    unittest.main()