"""Auth: login works, and protected/writer endpoints reject the wrong caller."""

from tests.conftest import make_user
from ten31portal.models import UserRole


def test_login_success(client, approver):
    resp = client.post(
        "/api/auth/login", json={"login": "approver", "password": "password123"}
    )
    assert resp.status_code == 200, resp.text
    assert resp.json()["username"] == "approver"


def test_login_wrong_password(client, approver):
    resp = client.post(
        "/api/auth/login", json={"login": "approver", "password": "nope"}
    )
    assert resp.status_code == 401


def test_me_requires_authentication(client):
    assert client.get("/api/auth/me").status_code == 401


def test_me_returns_current_user(auth_client):
    resp = auth_client.get("/api/auth/me")
    assert resp.status_code == 200
    assert resp.json()["role"] == "approver"


def test_writer_endpoint_rejects_viewer(client, session):
    """A viewer is authenticated but not a writer — create-entity must 403, not 401."""
    make_user(session, username="viewer", role=UserRole.viewer)
    login = client.post(
        "/api/auth/login", json={"login": "viewer", "password": "password123"}
    )
    assert login.status_code == 200
    resp = client.post("/api/entities", json={"name": "X", "type": "fund"})
    assert resp.status_code == 403