# -*- coding: utf-8 -*-
"""账号单一角色（去多身份）：登录返回空 identities、role=账号类型、按角色访问。"""
from __future__ import annotations

from fastapi.testclient import TestClient


def login(client: TestClient, username: str, password: str = "123456") -> dict:
    res = client.post("/auth/login", json={"username": username, "password": password})
    assert res.status_code == 200, res.text
    return res.json()


def auth(token: str) -> dict:
    return {"Authorization": f"Bearer {token}"}


def test_single_role_login(client):
    """opc01（单角色 OPC）登录：identities 恒空、role=opc_member、可按角色访问 OPC 端口。"""
    body = login(client, "opc01")
    assert body["identities"] == []
    assert body["role"] == "opc_member"
    assert bool(body["token"])

    res = client.get("/opc/dashboard", headers=auth(body["token"]))
    assert res.status_code == 200, res.text


def test_operator_login_has_operator_role(client):
    """pine（平台运营方超管）登录：role=operator，具备运营端权限。"""
    body = login(client, "pine")
    assert body["role"] == "operator"
    assert "permissions" in body and len(body["permissions"]) > 0
    assert any(p.startswith("menu:") for p in body["permissions"])


def test_select_identity_endpoint_removed(client):
    """多身份选择端点已移除：/auth/select-identity 不再存在（405）。"""
    body = login(client, "opc01")
    res = client.post(
        "/auth/select-identity",
        headers=auth(body["token"]),
        json={"identity_id": "whatever"},
    )
    assert res.status_code == 405 or res.status_code == 404