"""Tests for GET /users/operators — lead/manager-reachable operator picker list."""


def test_red_lead_can_list_operators(client, red_lead_headers, red_tech_user, blue_tech_user, red_lead_user):
    resp = client.get("/api/v1/users/operators", headers=red_lead_headers)
    assert resp.status_code == 200, resp.text
    usernames = {u["username"] for u in resp.json()}
    assert "redtech" in usernames
    assert "bluetech" in usernames
    assert "redlead" in usernames


def test_operators_list_excludes_viewers(client, red_lead_headers, db):
    from app.auth import hash_password
    from app.models.user import User

    viewer = User(
        username="viewer_ops", email="viewer_ops@test.com",
        hashed_password=hash_password("x"), role="viewer", is_active=True,
        must_change_password=False,
    )
    db.add(viewer)
    db.commit()

    resp = client.get("/api/v1/users/operators", headers=red_lead_headers)
    assert resp.status_code == 200
    usernames = {u["username"] for u in resp.json()}
    assert "viewer_ops" not in usernames


def test_red_tech_cannot_list_operators(client, red_tech_headers):
    resp = client.get("/api/v1/users/operators", headers=red_tech_headers)
    assert resp.status_code == 403


def test_admin_cannot_list_operators(client, auth_headers):
    """Admin administers the site — coordinating operators is a lead/manager call."""
    resp = client.get("/api/v1/users/operators", headers=auth_headers)
    assert resp.status_code == 403


def test_manager_can_list_operators(client, manager_headers, red_tech_user):
    resp = client.get("/api/v1/users/operators", headers=manager_headers)
    assert resp.status_code == 200, resp.text
    usernames = {u["username"] for u in resp.json()}
    assert "redtech" in usernames