import pytest

from pygitweb.permissions import (
	PERMISSION_ADD_PROJECTS,
	PERMISSION_SETTINGS,
	Permission,
	PermissionsMap,
	parse_permission_key,
	permission_key,
	project_matches_scope,
)


def test_parse_global_keys() -> None:
	assert parse_permission_key(PERMISSION_ADD_PROJECTS) is not None
	assert parse_permission_key(PERMISSION_SETTINGS) is not None
	assert parse_permission_key("pgw.unknown") is None
	assert parse_permission_key("*") is None


def test_parse_scoped_key() -> None:
	parsed = parse_permission_key("pgw.tasks.my/repo")
	assert parsed is not None
	assert parsed.permission is Permission.TASKS
	assert parsed.project_scope == "my/repo"


def test_permission_key_roundtrip() -> None:
	assert permission_key(Permission.BOARDS, "foo") == "pgw.boards.foo"
	assert permission_key(Permission.MR_CREATE, "foo") == "pgw.mr.create.foo"
	assert permission_key(Permission.MR_MERGE, "foo") == "pgw.mr.merge.foo"
	assert permission_key(Permission.HOOKS, "foo") == "pgw.hooks.foo"


def test_parse_mr_scoped_keys() -> None:
	create = parse_permission_key("pgw.mr.create.demo")
	assert create is not None
	assert create.permission is Permission.MR_CREATE
	merge = parse_permission_key("pgw.mr.merge.demo")
	assert merge is not None
	assert merge.permission is Permission.MR_MERGE


def test_project_glob() -> None:
	assert project_matches_scope("team/app", "team/*")
	assert not project_matches_scope("other/app", "team/*")
	assert project_matches_scope("anything", "*")


def test_superuser_grants_all() -> None:
	m = PermissionsMap.model_validate({
		"*": ["admin@example.com"],
		"pgw.tasks.secret": ["other@example.com"],
	})
	assert m.has_permission("admin@example.com", Permission.TASKS, "secret")
	assert m.has_permission("admin@example.com", Permission.SETTINGS)
	assert m.has_permission("other@example.com", Permission.TASKS, "secret")
	assert not m.has_permission("other@example.com", Permission.SETTINGS)
	assert not m.has_permission("other@example.com", Permission.TASKS, "public")


def test_scoped_grant() -> None:
	m = PermissionsMap.model_validate({
		"*": [],
		"pgw.comments.proj-a": ["reader@example.com"],
		"pgw.boards.team/*": ["lead@example.com"],
	})
	assert m.has_permission("reader@example.com", Permission.COMMENTS, "proj-a")
	assert not m.has_permission("reader@example.com", Permission.TASKS, "proj-a")
	assert m.has_permission("lead@example.com", Permission.BOARDS, "team/widget")
	assert not m.has_permission("lead@example.com", Permission.BOARDS, "other/widget")


def test_email_case_insensitive() -> None:
	m = PermissionsMap.model_validate({"*": [], PERMISSION_SETTINGS: ["Admin@Example.COM"]})
	assert m.has_permission("admin@example.com", Permission.SETTINGS)


def test_rejects_unknown_key() -> None:
	with pytest.raises(ValueError, match="unknown permission key"):
		PermissionsMap.model_validate({"pgw.notreal": ["a@b.com"]})


def test_ensures_wildcard_key() -> None:
	m = PermissionsMap.model_validate({PERMISSION_ADD_PROJECTS: ["u@x.com"]})
	assert "*" in m.root