"""Admin must be locked out of every Test-workflow *action* endpoint.

Admin administers the site; leads/managers/operators run the test workflow.
The permission dependency runs before any DB lookup, so a random UUID is
enough to prove the 403 — the request never reaches the handler body.
"""

import uuid

import pytest

DUMMY_ID = str(uuid.uuid4())


@pytest.mark.parametrize(
    "method,path,payload",
    [
        ("post", f"/api/v1/tests/{DUMMY_ID}/review-red", {"decision": "approve"}),
        ("post", f"/api/v1/tests/{DUMMY_ID}/review-blue", {"decision": "approve"}),
        ("post", f"/api/v1/tests/{DUMMY_ID}/validate-red", {"red_validation_status": "approved"}),
        ("post", f"/api/v1/tests/{DUMMY_ID}/validate-blue", {"blue_validation_status": "approved"}),
        ("post", f"/api/v1/tests/{DUMMY_ID}/resolve-dispute", {"target_team": "red"}),
        ("post", f"/api/v1/tests/{DUMMY_ID}/request-discussion", None),
        ("post", f"/api/v1/tests/{DUMMY_ID}/reopen", None),
        ("post", f"/api/v1/tests/{DUMMY_ID}/hold", {"reason": "x"}),
        ("post", f"/api/v1/tests/{DUMMY_ID}/resume", None),
        ("post", f"/api/v1/tests/{DUMMY_ID}/assign", {"red_tech_assignee": DUMMY_ID}),
        ("patch", f"/api/v1/tests/{DUMMY_ID}/classification", {"data_classification": "pii"}),
        ("post", f"/api/v1/tests/{DUMMY_ID}/start-execution", None),
        ("post", f"/api/v1/tests/{DUMMY_ID}/submit-red", None),
        ("post", f"/api/v1/tests/{DUMMY_ID}/start-blue-work", None),
        ("post", f"/api/v1/tests/{DUMMY_ID}/submit-blue", None),
        ("post", f"/api/v1/tests/{DUMMY_ID}/pause-timer", None),
        ("post", f"/api/v1/tests/{DUMMY_ID}/resume-timer", None),
        ("patch", f"/api/v1/tests/{DUMMY_ID}/red", {"procedure_text": "x"}),
        ("patch", f"/api/v1/tests/{DUMMY_ID}/blue", {"detection_result": "detected"}),
        ("patch", f"/api/v1/tests/{DUMMY_ID}", {"name": "x"}),
        ("patch", f"/api/v1/tests/{DUMMY_ID}/remediation", {"remediation_status": "completed"}),
        ("post", "/api/v1/tests", {"technique_id": DUMMY_ID, "name": "x"}),
        ("post", "/api/v1/tests/from-template", {"template_id": DUMMY_ID, "technique_id": DUMMY_ID}),
        ("post", "/api/v1/tests/import-rt", {"name": "x", "techniques": []}),
        ("post", "/api/v1/campaigns", {"name": "x"}),
        ("post", f"/api/v1/campaigns/from-threat-actor/{DUMMY_ID}", None),
    ],
)
def test_admin_forbidden(client, auth_headers, method, path, payload):
    resp = getattr(client, method)(path, json=payload, headers=auth_headers)
    assert resp.status_code == 403, f"{method.upper()} {path} -> {resp.status_code}: {resp.text}"


@pytest.mark.parametrize(
    "method,path,payload",
    [
        ("post", "/api/v1/test-templates", {"name": "x", "mitre_technique_id": "T1059"}),
        ("patch", f"/api/v1/test-templates/{DUMMY_ID}", {"name": "x"}),
        ("patch", f"/api/v1/test-templates/{DUMMY_ID}/toggle-active", None),
        ("delete", f"/api/v1/test-templates/{DUMMY_ID}", None),
        ("patch", "/api/v1/test-templates/bulk-activate", {"template_ids": [DUMMY_ID], "is_active": True}),
    ],
)
def test_admin_forbidden_templates(client, auth_headers, method, path, payload):
    kwargs = {"headers": auth_headers}
    if payload is not None:
        kwargs["json"] = payload
    resp = getattr(client, method)(path, **kwargs)
    assert resp.status_code == 403, f"{method.upper()} {path} -> {resp.status_code}: {resp.text}"