import pytest

from app.middleware.trusted_context import TrustedContextError, parse_trusted_context


def test_parse_org_member_context():
    ctx = parse_trusted_context(
        {
            "X-Request-Id": "req-1",
            "X-Org-Id": "org-1",
            "X-User-Id": "user-1",
            "X-User-Email": "dev@example.com",
            "X-Org-Role": "owner",
            "X-Plan-Code": "free",
        }
    )
    assert ctx.request_id == "req-1"
    assert ctx.org_id == "org-1"
    assert ctx.user_id == "user-1"
    assert ctx.is_org_member is True
    assert ctx.can_access_repo("lucos:ws:abc")
    assert ctx.filter_repo_ids(["a", "b"]) == ["a", "b"]


def test_parse_team_scoped_context():
    ctx = parse_trusted_context(
        {
            "x-request-id": "req-2",
            "x-org-id": "org-1",
            "x-user-id": "user-2",
            "x-repo-ids": "repo-a, repo-b",
            "x-team-ids": "team-1",
        }
    )
    assert ctx.is_org_member is False
    assert ctx.allowed_repo_ids == ("repo-a", "repo-b")
    assert ctx.can_access_repo("repo-a") is True
    assert ctx.can_access_repo("repo-c") is False
    assert ctx.filter_repo_ids(["repo-a", "repo-c"]) == ["repo-a"]


def test_missing_required_headers():
    with pytest.raises(TrustedContextError, match="X-Org-Id"):
        parse_trusted_context({"X-Request-Id": "req-3", "X-User-Id": "user-1"})


def test_protected_route_requires_trusted_headers():
    from fastapi.testclient import TestClient
    from app.main import app

    test_client = TestClient(app)
    response = test_client.post(
        "/api/v1/indexing/chunks",
        json={
            "repo_id": "lucos:ws:abc",
            "chunks": [],
        },
    )
    assert response.status_code == 401
    assert response.json()["error"]["code"] == "TRUSTED_CONTEXT_REQUIRED"