"""Staff status is derived from the role, never asserted.

The bug these pin: ``create_user`` and ``update_user`` used to set
``is_staff=True`` on every account, so a self-registered buyer came out as staff
— and, because ``update_user`` runs on every sign-in, a buyer row created
correctly would still flip to staff the first time they signed in. The second
case is the one that passes a first test and fails later, so it is covered
directly.
"""
from django.contrib.auth import get_user_model
from django.test import TestCase

from .auth import KeycloakOIDCBackend, is_staff_for_role
from .keycloak import _split_name

User = get_user_model()


class SplitNameTests(TestCase):
    """Both Keycloak name fields must be non-empty, or sign-in shows the
    "Update Account Information" (VERIFY_PROFILE) step."""

    def test_a_two_part_name_splits(self):
        self.assertEqual(_split_name("Ada Greenfield"), ("Ada", "Greenfield"))

    def test_a_multi_part_name_keeps_the_last_word_as_the_surname(self):
        self.assertEqual(_split_name("Ada Mary Greenfield"), ("Ada Mary", "Greenfield"))

    def test_a_single_word_name_fills_both_fields(self):
        self.assertEqual(_split_name("Ada"), ("Ada", "Ada"))

    def test_an_empty_name_yields_empty_fields(self):
        self.assertEqual(_split_name("   "), ("", ""))


class StaffRoleTests(TestCase):
    def setUp(self):
        self.backend = KeycloakOIDCBackend()

    def test_only_ops_and_admin_are_staff(self):
        self.assertFalse(is_staff_for_role("buyer"))
        self.assertTrue(is_staff_for_role("ops"))
        self.assertTrue(is_staff_for_role("admin"))
        self.assertTrue(is_staff_for_role("buyer", is_superuser=True))

    def test_create_user_derives_staff_from_the_claims_role(self):
        buyer = self.backend.create_user(
            {"email": "signup-buyer@example.com", "name": "Buyer One", "sub": "sub-buyer", "role": "buyer"}
        )
        self.assertEqual(buyer.role, "buyer")
        self.assertFalse(buyer.is_staff)

        ops = self.backend.create_user(
            {"email": "signup-ops@example.com", "name": "Ops One", "sub": "sub-ops", "role": "ops"}
        )
        self.assertTrue(ops.is_staff)

    def test_create_user_defaults_to_buyer_without_a_role_claim(self):
        user = self.backend.create_user(
            {"email": "signup-norole@example.com", "name": "No Role", "sub": "sub-norole"}
        )
        self.assertEqual(user.role, "buyer")
        self.assertFalse(user.is_staff)

    def test_update_user_does_not_staff_a_buyer(self):
        user = User.objects.create_user(
            email="buyer-stays@example.com", role="buyer", is_staff=False, keycloak_id="sub-1"
        )
        self.backend.update_user(
            user, {"email": "buyer-stays@example.com", "name": "Buyer", "sub": "sub-1", "role": "buyer"}
        )
        user.refresh_from_db()
        self.assertEqual(user.role, "buyer")
        self.assertFalse(user.is_staff)

    def test_update_user_staffs_ops_and_admin(self):
        for role in ("ops", "admin"):
            user = User.objects.create_user(
                email=f"{role}-signin@example.com", role="buyer", is_staff=False,
                keycloak_id=f"sub-{role}",
            )
            self.backend.update_user(
                user, {"email": user.email, "name": role, "sub": user.keycloak_id, "role": role}
            )
            user.refresh_from_db()
            self.assertEqual(user.role, role)
            self.assertTrue(user.is_staff)

    def test_update_user_keeps_the_existing_role_when_the_claim_is_absent(self):
        user = User.objects.create_user(
            email="ops-no-role-claim@example.com", role="ops", is_staff=True, keycloak_id="sub-2"
        )
        self.backend.update_user(user, {"email": user.email, "name": "Ops", "sub": "sub-2"})
        user.refresh_from_db()
        self.assertEqual(user.role, "ops")
        self.assertTrue(user.is_staff)

    def test_update_user_preserves_a_superuser(self):
        user = User.objects.create_superuser(
            email="super@example.com", password="pass1234", role="buyer", keycloak_id="sub-3"
        )
        self.backend.update_user(
            user, {"email": user.email, "name": "Super", "sub": "sub-3", "role": "buyer"}
        )
        user.refresh_from_db()
        self.assertTrue(user.is_superuser)
        self.assertTrue(user.is_staff)