from fastapi.testclient import TestClient

from tests.conftest import TEST_PASSWORD


def test_login_and_current_session(client: TestClient) -> None:
    response = client.post(
        "/api/v1/auth/login",
        json={
            "workspace": "maskan",
            "email": "owner@example.com",
            "password": TEST_PASSWORD,
        },
    )
    assert response.status_code == 200
    payload = response.json()
    assert payload["user"]["role"] == "owner"
    assert payload["tenant"]["slug"] == "maskan"

    session = client.get(
        "/api/v1/auth/me",
        headers={"Authorization": f"Bearer {payload['access_token']}"},
    )
    assert session.status_code == 200
    assert session.json()["tenant"]["name"] == "Maskan Technologies"


def test_login_failure_is_generic(client: TestClient) -> None:
    response = client.post(
        "/api/v1/auth/login",
        json={
            "workspace": "maskan",
            "email": "owner@example.com",
            "password": "incorrect-password",
        },
    )
    assert response.status_code == 401
    assert "workspace, email, or password" in response.json()["error"]["message"]


def test_viewer_cannot_create_contact(
    client: TestClient,
    viewer_headers: dict[str, str],
) -> None:
    response = client.post(
        "/api/v1/contacts",
        headers=viewer_headers,
        json={"first_name": "Read", "last_name": "Only"},
    )
    assert response.status_code == 403