from django.contrib.auth import get_user_model
from django.contrib.auth.models import Group, Permission
from django.core.management import call_command


def test_login_me_and_logout_flow(client, db):
    call_command("bootstrap_governance")

    login = client.post(
        "/api/accounts/auth/login",
        data={"username": "admin", "password": "admin12345"},
        content_type="application/json",
    )
    assert login.status_code == 200
    assert login.json()["username"] == "admin"

    me = client.get("/api/accounts/auth/me")
    assert me.status_code == 200
    payload = me.json()
    assert payload["username"] == "admin"
    assert "system.user.manage" in payload["permissions"]
    assert [menu["code"] for menu in payload["menus"]] == [
        "workbench",
        "business",
        "knowledge",
        "platform",
        "system",
    ]
    knowledge = next(menu for menu in payload["menus"] if menu["code"] == "knowledge")
    assert [item["code"] for item in knowledge["children"]] == [
        "platform.knowledge",
        "knowledge.search",
        "business.solutions",
    ]
    assert not any(
        item["code"] == "workbench.overview"
        for menu in payload["menus"]
        for item in menu["children"]
    )

    logout = client.post("/api/accounts/auth/logout")
    assert logout.status_code == 200
    assert client.get("/api/accounts/auth/me").status_code == 401


def test_login_rejects_invalid_password(client, db):
    get_user_model().objects.create_user(username="u", password="right")

    response = client.post(
        "/api/accounts/auth/login",
        data={"username": "u", "password": "wrong"},
        content_type="application/json",
    )

    assert response.status_code == 401


def test_current_user_menu_tree_excludes_unauthorized_second_level_pages(client, db):
    call_command("bootstrap_governance")
    role = Group.objects.create(name="仅工单查看")
    role.permissions.add(Permission.objects.get(codename="ticket.view"))
    user = get_user_model().objects.create_user(username="ticket-reader", password="password")
    user.groups.add(role)

    login = client.post(
        "/api/accounts/auth/login",
        data={"username": "ticket-reader", "password": "password"},
        content_type="application/json",
    )
    assert login.status_code == 200

    payload = client.get("/api/accounts/auth/me").json()
    children = [item["code"] for menu in payload["menus"] for item in menu["children"]]
    assert children == ["business.tickets", "system.design"]