"""API-level validation tests for user creation (SEC-004, SEC-007)."""


def test_create_user_weak_password_rejected(client, admin_user, admin_token):
    response = client.post(
        "/api/v1/users",
        json={
            "username": "newuser",
            "password": "123",
            "email": "new@test.com",
            "role": "viewer",
        },
        headers={"Authorization": f"Bearer {admin_token}"},
    )
    assert response.status_code == 422
    assert "password" in response.text.lower()


def test_create_user_reserved_username(client, admin_user, admin_token):
    response = client.post(
        "/api/v1/users",
        json={
            "username": "system",
            "password": "SecurePass123!@#",
            "email": "sys@test.com",
            "role": "viewer",
        },
        headers={"Authorization": f"Bearer {admin_token}"},
    )
    assert response.status_code == 422


def test_create_user_invalid_username_chars(client, admin_user, admin_token):
    response = client.post(
        "/api/v1/users",
        json={
            "username": "../admin",
            "password": "SecurePass123!@#",
            "email": "bad@test.com",
            "role": "viewer",
        },
        headers={"Authorization": f"Bearer {admin_token}"},
    )
    assert response.status_code == 422


def test_create_user_valid_password_accepted(client, admin_user, admin_token):
    response = client.post(
        "/api/v1/users",
        json={
            "username": "validuser99",
            "password": "ValidPass123!@#",
            "email": "valid@test.com",
            "role": "viewer",
        },
        headers={"Authorization": f"Bearer {admin_token}"},
    )
    assert response.status_code == 201
    assert response.json()["username"] == "validuser99"


def test_create_user_with_manager_role_accepted(client, admin_user, admin_token):
    """Regression: 'manager' is a real, actively-used role (dispute mediation,
    operator assignment) but was missing from the creation whitelist."""
    response = client.post(
        "/api/v1/users",
        json={
            "username": "newmanager",
            "password": "ValidPass123!@#",
            "email": "newmanager@test.com",
            "role": "manager",
        },
        headers={"Authorization": f"Bearer {admin_token}"},
    )
    assert response.status_code == 201, response.text
    assert response.json()["role"] == "manager"


def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
    response = client.post(
        "/api/v1/users",
        json={
            "username": "badroleuser",
            "password": "ValidPass123!@#",
            "email": "badrole@test.com",
            "role": "superuser",
        },
        headers={"Authorization": f"Bearer {admin_token}"},
    )
    assert response.status_code == 400
    assert "Invalid role" in response.text