"""Test the GET identity/admin/profiles endpoint."""

import requests

from tests.integration import config, utils


def test_d3_admin_gets_subaccount_users(bearer_token_user_without_vendor_star):
    """Test that the admin of a vendor can call the endpoint and get a subaccount user."""
    response = requests.get(
        f'{config.QA_BASE_URL}/identity/admin/profiles?term=test&limit=100',
        headers={
            'Authorization': f'Bearer {bearer_token_user_without_vendor_star}',
            'Orchard-Profile-Type': 'SettingsProfile',
            'Orchard-Profile-Id': utils.OWS_PERMISSIONS_TEST_USER_SETTINGS_PROFILE_ID,
            'Orchard-Identity-Id': utils.OWS_PERMISSIONS_TEST_USER_ID,
        },
    )

    assert response.status_code == 200
    assert any(
        # The no settings user has insights access to a subaccount owned by a vendor that
        # the caller has settings admin access to.
        item
        for item in response.json()['items']
        if item['id'] == utils.NO_SETTINGS_USER_ID
    )