"""Manager role — creating tests from templates.

A manager organizes and validates work rather than executing it, but they
should still be able to seed a test from the catalog directly (same as a
red_lead/blue_lead), not just approve/reject what leads submit.
"""


def test_manager_can_create_test_from_template(api, auth_headers, red_lead_headers, manager_headers):
    technique = api(
        "post", "/api/v1/techniques", auth_headers,
        json={"mitre_id": "T1059.400", "name": "Command Line Manager Test"},
    )
    assert technique.status_code == 201, technique.text
    technique_id = technique.json()["id"]

    template = api(
        "post", "/api/v1/test-templates", red_lead_headers,
        json={
            "mitre_technique_id": "T1059.400",
            "name": "Manager-usable template",
            "attack_procedure": "Run a discovery command.",
        },
    )
    assert template.status_code == 201, template.text
    template_id = template.json()["id"]

    resp = api(
        "post", "/api/v1/tests/from-template", manager_headers,
        json={"template_id": template_id, "technique_id": technique_id},
    )
    assert resp.status_code == 201, resp.text
    assert resp.json()["name"] == "Manager-usable template"


def test_admin_still_cannot_create_test_from_template(api, red_lead_headers, auth_headers):
    """require_any_role_strict keeps site-admin separate from workflow
    actions — adding manager to the allow-list must not accidentally
    reintroduce an admin bypass here."""
    technique = api(
        "post", "/api/v1/techniques", auth_headers,
        json={"mitre_id": "T1059.401", "name": "Command Line Admin Test"},
    )
    technique_id = technique.json()["id"]

    template = api(
        "post", "/api/v1/test-templates", red_lead_headers,
        json={"mitre_technique_id": "T1059.401", "name": "Admin-blocked template"},
    )
    template_id = template.json()["id"]

    resp = api(
        "post", "/api/v1/tests/from-template", auth_headers,
        json={"template_id": template_id, "technique_id": technique_id},
    )
    assert resp.status_code == 403