tests/unit/test_admin.py

"""
Unit tests for Admin API endpoints and RBAC permission checks.
"""
from __future__ import annotations

import pytest
from httpx import AsyncClient


@pytest.mark.asyncio
async def test_admin_endpoints_access_control(client: AsyncClient):
    # 1. Register admin user (first user gets Admin role)
    reg = await client.post("/api/v1/auth/register", json={
        "email": "admin_test@company.com",
        "password": "Password123!",
        "full_name": "Admin Tester",
        "tenant_name": "Admin Corp"
    })
    admin_token = reg.json()["tokens"]["access_token"]
    admin_headers = {"Authorization": f"Bearer {admin_token}"}

    # 2. Admin can list users
    response = await client.get("/api/v1/admin/users", headers=admin_headers)
    assert response.status_code == 200, response.text
    users = response.json()
    assert len(users) >= 1
    assert users[0]["email"] == "admin_test@company.com"

    # 3. Admin can invite a user with employee role
    invite_req = {
        "email": "invited_emp@company.com",
        "full_name": "Invited Employee",
        "role": "employee",
        "password": "Password123!"
    }
    response = await client.post("/api/v1/admin/users/invite", headers=admin_headers, json=invite_req)
    assert response.status_code == 201, response.text
    invited_user = response.json()
    assert invited_user["email"] == "invited_emp@company.com"
    assert invited_user["role"] == "employee"

    # 4. Login as non-admin employee
    login_form = {"username": "invited_emp@company.com", "password": "Password123!"}
    emp_login = await client.post("/api/v1/auth/login", data=login_form)
    emp_token = emp_login.json()["access_token"]
    emp_headers = {"Authorization": f"Bearer {emp_token}"}

    # 5. Non-admin user MUST be blocked (403 Forbidden) from admin endpoints
    response = await client.get("/api/v1/admin/users", headers=emp_headers)
    assert response.status_code == 403
    assert response.json()["detail"]["error"] == "insufficient_permissions"

    # 6. Admin can fetch audit logs and tenant details
    response = await client.get("/api/v1/admin/audit-logs", headers=admin_headers)
    assert response.status_code == 200

    response = await client.get("/api/v1/admin/tenant", headers=admin_headers)
    assert response.status_code == 200
    assert response.json()["slug"] == "admin-corp"