"""Test the GET /identity/admin/all-label-access endpoint."""

import requests

from tests.integration import config, utils


def test_check_my_all_label_access_has_access(bearer_token_user_with_vendor_star: str) -> None:
    """Test GET /v2/identity/self/all-label-access when caller is superadmin."""
    result = requests.get(
        f'{config.QA_BASE_URL}/v2/identity/self/all-label-access',
        headers={
            'Authorization': f'Bearer {bearer_token_user_with_vendor_star}',
            # Needed for the Split check
            'Orchard-Identity-Id': utils.OWS_ACCOUNT_TEST_USER_ID,
        },
    )

    assert result.status_code == 200
    assert result.json()['has_access'] is True


def test_check_my_all_label_access_has_vendor_star_but_not_in_flag(
    bearer_token_user_vendor_star_not_superadmin: str,
) -> None:
    """Test GET /v2/identity/self/all-label-access when caller has vendor * but no flag."""
    result = requests.get(
        f'{config.QA_BASE_URL}/v2/identity/self/all-label-access',
        headers={
            'Authorization': f'Bearer {bearer_token_user_vendor_star_not_superadmin}',
            'Orchard-Identity-Id': utils.OWS_PERMISSIONS_VENDOR_STAR_USER_ID,
        },
    )

    assert result.status_code == 200
    assert result.json()['has_access'] is False


def test_check_my_all_label_access_neither_vendor_star_nor_flag(
    bearer_token_user_without_vendor_star: str,
) -> None:
    """Test GET /v2/identity/self/all-label-access when caller has no vendor * and no flag."""
    result = requests.get(
        f'{config.QA_BASE_URL}/v2/identity/self/all-label-access',
        headers={
            'Authorization': f'Bearer {bearer_token_user_without_vendor_star}',
            'Orchard-Identity-Id': utils.OWS_PERMISSIONS_TEST_USER_ID,
        },
    )

    assert result.status_code == 200
    assert result.json()['has_access'] is False