"""RBAC engine: can() decisions + DOES_SYSTEM_ADMIN bypass."""

from __future__ import annotations

from sqlalchemy.orm import Session

from ypms.security.models import Permission
from ypms.security.rbac import ADMIN_ROLE, can
from ypms.users.models import Role, User, UserRole


def _mkuser_with_role(db: Session, *, username: str, role_code: str) -> User:
    role = Role(code=role_code, description=role_code)
    db.add(role)
    db.flush()
    user = User(username=username, email=f"{username}@example.com", password_hash="x")
    db.add(user)
    db.flush()
    db.add(UserRole(user_id=user.id, role_id=role.id))
    db.flush()
    db.refresh(user)
    return user


def test_admin_role_bypasses_all_checks(db: Session) -> None:
    admin = _mkuser_with_role(db, username="admin", role_code=ADMIN_ROLE)
    # No permission rows exist; admin still passes.
    assert can(db, admin, action="Create", entity="Registrant") is True
    assert can(db, admin, action="Delete", entity="Anything") is True


def test_user_with_no_roles_is_denied(db: Session) -> None:
    user = User(username="orphan", email="orphan@example.com", password_hash="x")
    db.add(user)
    db.flush()
    db.refresh(user)
    assert can(db, user, action="View", entity="Registrant") is False


def test_permission_row_grants_specific_action(db: Session) -> None:
    user = _mkuser_with_role(db, username="staff", role_code="OYP_STAFF")
    role_id = user.roles[0].id
    db.add(Permission(role_id=role_id, entity="Registrant", action="View"))
    db.flush()

    assert can(db, user, action="View", entity="Registrant") is True
    # Different action on same entity: denied.
    assert can(db, user, action="Delete", entity="Registrant") is False
    # Same action on different entity: denied.
    assert can(db, user, action="View", entity="Host") is False


def test_multiple_roles_union_permissions(db: Session) -> None:
    role_a = Role(code="ROLE_A")
    role_b = Role(code="ROLE_B")
    db.add_all([role_a, role_b])
    db.flush()

    user = User(username="multi", email="m@example.com", password_hash="x")
    db.add(user)
    db.flush()
    db.add_all(
        [UserRole(user_id=user.id, role_id=role_a.id), UserRole(user_id=user.id, role_id=role_b.id)]
    )
    db.add(Permission(role_id=role_a.id, entity="Registrant", action="View"))
    db.add(Permission(role_id=role_b.id, entity="Registrant", action="Edit"))
    db.flush()
    db.refresh(user)

    assert can(db, user, action="View", entity="Registrant") is True
    assert can(db, user, action="Edit", entity="Registrant") is True
    assert can(db, user, action="Delete", entity="Registrant") is False