import pytest

from src.domain.codegen.legacy_user_store import DiscoveredUser
from src.domain.project_auth.staff_directory import (
    SUPER_ADMIN_ROLE,
    STAFF_ADMIN_ROLE,
    WorkspaceAppIdentity,
    app_role_for_workspace_member,
    remap_legacy_app_role,
)


def test_only_workspace_owner_is_generated_app_super_admin():
    assert app_role_for_workspace_member(workspace_role="owner", is_owner=True) == SUPER_ADMIN_ROLE
    assert app_role_for_workspace_member(workspace_role="admin", is_owner=False) == STAFF_ADMIN_ROLE


@pytest.mark.parametrize("workspace_role", ["viewer", "billing", "editor", "developer", "member", None, "future_role"])
def test_non_administrative_workspace_roles_do_not_inherit_app_admin(workspace_role):
    assert app_role_for_workspace_member(workspace_role=workspace_role, is_owner=False) is None


def test_git_seed_super_admin_is_demoted_unless_owner():
    owner = "owner@example.com"
    assert remap_legacy_app_role("owner@example.com", "admin", owner) == SUPER_ADMIN_ROLE
    assert (
        remap_legacy_app_role("muhammad.zakir@pie-solutions.com", "super_admin", owner)
        == STAFF_ADMIN_ROLE
    )
    assert remap_legacy_app_role("mohsin@pie-solutions.com", "admin", owner) == STAFF_ADMIN_ROLE


def test_unknown_owner_leaves_legacy_roles_unchanged():
    assert remap_legacy_app_role("zakir@example.com", "super_admin", None) == "super_admin"


def test_workspace_identities_overwrite_git_seed_roles():
    from dataclasses import replace as dc_replace

    git = DiscoveredUser(
        "muhammad.zakir@pie-solutions.com", "super_admin", "Zakir", "git"
    )
    workspace = WorkspaceAppIdentity(
        email="muhammad.zakir@pie-solutions.com",
        name="Muhammad Zakir",
        workspace_role="admin",
        app_role=STAFF_ADMIN_ROLE,
        is_owner=False,
    )
    owner = "owner@example.com"
    remapped = remap_legacy_app_role(git.email, git.role, owner)
    assert remapped == STAFF_ADMIN_ROLE
    assert dc_replace(git, role=workspace.app_role).role == "admin"