from django.contrib.auth import get_user_model
from django.contrib.auth.models import Group
from django.core.management import call_command

from apps.accounts.models import MenuItem, UserGroup


def login_admin(client):
    call_command("bootstrap_governance")
    user = get_user_model().objects.get(username="admin")
    client.force_login(user)
    return user


def test_admin_manages_users_groups_roles_permissions_and_menus(client, db):
    login_admin(client)

    created_user = client.post(
        "/api/accounts/users",
        data={
            "username": "support",
            "display_name": "技术支持一号",
            "email": "support@example.com",
            "password": "Copper-River-42",
            "is_active": True,
        },
        content_type="application/json",
    )
    assert created_user.status_code == 200
    user_id = created_user.json()["id"]

    user_group = client.post(
        "/api/accounts/user-groups",
        data={"name": "一线支持组", "code": "support_l1", "description": "处理一线工单"},
        content_type="application/json",
    )
    assert user_group.status_code == 200
    user_group_id = user_group.json()["id"]

    members = client.post(
        f"/api/accounts/user-groups/{user_group_id}/members",
        data={"user_ids": [user_id]},
        content_type="application/json",
    )
    assert members.status_code == 200
    assert UserGroup.objects.get(id=user_group_id).users.filter(id=user_id).exists()

    role = client.post(
        "/api/accounts/roles",
        data={"name": "工单观察员", "permission_codes": ["ticket.view"]},
        content_type="application/json",
    )
    assert role.status_code == 200
    role_id = role.json()["id"]

    role_permissions = client.post(
        f"/api/accounts/roles/{role_id}/permissions",
        data={"permission_codes": ["ticket.view", "solution.view"]},
        content_type="application/json",
    )
    assert role_permissions.status_code == 200
    assert set(role_permissions.json()["permission_codes"]) == {"ticket.view", "solution.view"}

    user_roles = client.post(
        f"/api/accounts/users/{user_id}/roles",
        data={"role_ids": [role_id]},
        content_type="application/json",
    )
    assert user_roles.status_code == 200
    assert Group.objects.get(id=role_id).user_set.filter(id=user_id).exists()

    menus = client.get("/api/accounts/menus")
    assert menus.status_code == 200
    menu_id = MenuItem.objects.get(code="system.users").id
    updated_menu = client.patch(
        f"/api/accounts/menus/{menu_id}",
        data={"title": "账号管理", "permission_code": "system.user.view"},
        content_type="application/json",
    )
    assert updated_menu.status_code == 200
    assert updated_menu.json()["title"] == "账号管理"


def test_anonymous_governance_access_is_denied(client, db):
    response = client.get("/api/accounts/users")

    assert response.status_code == 401