"""Regression: project/workspace routes must enforce workspace membership (not only billing)."""
from unittest.mock import AsyncMock, MagicMock
from uuid import uuid4

import pytest

from src.core.exceptions import NotFoundError
from src.domain.billing.productive_access_policy import ProductiveAccessPolicy


@pytest.mark.asyncio
async def test_require_for_workspace_raises_when_user_not_member():
    billing = MagicMock()
    billing.require_active_billing = AsyncMock()
    workspace_repo = MagicMock()
    membership_repo = MagicMock()
    membership_repo.get = AsyncMock(return_value=None)
    totp_repo = MagicMock()
    webauthn_repo = MagicMock()

    policy = ProductiveAccessPolicy(
        billing=billing,
        workspace_repo=workspace_repo,
        membership_repo=membership_repo,
        totp_repo=totp_repo,
        webauthn_repo=webauthn_repo,
    )

    with pytest.raises(NotFoundError, match="Project not found"):
        await policy.require_for_workspace(uuid4(), uuid4())

    membership_repo.get.assert_awaited_once()