from uuid import uuid4
from app_new.extensions import db
from app_new.core.models import User, Role, Permission, RolePermission, UserPermission
from app_new.core.authorization import has_permission

def test_custom_role_permission_and_override(app):
    with app.app_context():
        slug = "custom_" + uuid4().hex[:8]
        role = Role(slug=slug, name="Gestionnaire test", is_system=False)
        permission = Permission(code="stock.test.view", name="Stock test", module="stock", action="view")
        db.session.add_all([role, permission]); db.session.flush()
        db.session.add(RolePermission(role_id=role.id, permission_id=permission.id, effect="allow"))
        user = User(username="rbac_" + uuid4().hex[:8], email=uuid4().hex + "@test.local", full_name="RBAC", role=slug)
        user.set_password("test-password-strong")
        db.session.add(user); db.session.commit()
        assert has_permission("stock.test.view", user)
        assert not has_permission("stock.test.edit", user)
        db.session.add(UserPermission(user_id=user.id, permission_id=permission.id, effect="deny"))
        db.session.commit()
        assert not has_permission("stock.test.view", user)

def test_admin_rbac_page_requires_authentication(client):
    response = client.get("/admin/roles")
    assert response.status_code == 302
    assert "/auth/login" in response.location