"""Tests for auth, RBAC, and module rules — core MVP correctness."""

from app.core.rbac import Role, has_any_role, has_role, is_staff_or_above
from app.core.security import create_access_token, decode_access_token


class TestJWT:
    def test_create_and_decode_token(self):
        data = {"sub": "user-123", "email": "test@example.com", "roles": ["learner"]}
        token = create_access_token(data)
        decoded = decode_access_token(token)
        assert decoded is not None
        assert decoded["sub"] == "user-123"
        assert decoded["email"] == "test@example.com"
        assert decoded["roles"] == ["learner"]

    def test_decode_invalid_token_returns_none(self):
        result = decode_access_token("invalid.token.here")
        assert result is None

    def test_decode_none_returns_none(self):
        result = decode_access_token("")
        assert result is None


class TestRBAC:
    def test_has_role_true(self):
        assert has_role(["learner"], Role.LEARNER) is True

    def test_has_role_false(self):
        assert has_role(["learner"], Role.LD_ADMIN) is False

    def test_has_any_role_true(self):
        assert has_any_role(["sales_manager"], [Role.LEARNER, Role.SALES_MANAGER]) is True

    def test_has_any_role_false(self):
        assert has_any_role(["learner"], [Role.LD_ADMIN, Role.SALES_MANAGER]) is False

    def test_is_staff_or_above_true(self):
        assert is_staff_or_above(["sales_manager"]) is True
        assert is_staff_or_above(["ld_admin"]) is True

    def test_is_staff_or_above_false(self):
        assert is_staff_or_above(["learner"]) is False

    def test_empty_roles(self):
        assert has_role([], Role.LEARNER) is False
        assert is_staff_or_above([]) is False