import importlib.util
from pathlib import Path
import sys
import unittest


_MODULE_PATH = Path(__file__).parents[1] / "app" / "security" / "policy.py"
_SPEC = importlib.util.spec_from_file_location("authorization_policy_under_test", _MODULE_PATH)
assert _SPEC is not None and _SPEC.loader is not None
_POLICY = importlib.util.module_from_spec(_SPEC)
sys.modules[_SPEC.name] = _POLICY
_SPEC.loader.exec_module(_POLICY)

Actor = _POLICY.Actor
AuthorizationError = _POLICY.AuthorizationError
Role = _POLICY.Role
assert_can_access_resource = _POLICY.assert_can_access_resource
assert_can_manage_llm_settings = _POLICY.assert_can_manage_llm_settings
assert_can_manage_user = _POLICY.assert_can_manage_user


class AuthorizationPolicyTests(unittest.TestCase):
    def setUp(self):
        self.admin = Actor(user_id="admin-1", organization_id="org-a", role=Role.ADMIN)
        self.user = Actor(user_id="user-1", organization_id="org-a", role=Role.USER)
        self.other_user = Actor(user_id="user-2", organization_id="org-a", role=Role.USER)
        self.super_admin = Actor(
            user_id="root-1", organization_id="platform", role=Role.SUPER_ADMIN
        )

    def test_user_can_access_owned_resource_in_own_organization(self):
        assert_can_access_resource(
            self.user,
            resource_organization_id="org-a",
            owner_user_id="user-1",
        )

    def test_user_cannot_access_another_users_resource_in_same_organization(self):
        with self.assertRaises(AuthorizationError):
            assert_can_access_resource(
                self.user,
                resource_organization_id="org-a",
                owner_user_id="user-2",
            )

    def test_user_cannot_access_resource_from_another_organization(self):
        with self.assertRaises(AuthorizationError):
            assert_can_access_resource(
                self.user,
                resource_organization_id="org-b",
                owner_user_id="user-1",
            )

    def test_admin_can_access_resources_in_own_organization(self):
        assert_can_access_resource(
            self.admin,
            resource_organization_id="org-a",
            owner_user_id="user-2",
        )

    def test_admin_cannot_cross_organization_boundary(self):
        with self.assertRaises(AuthorizationError):
            assert_can_access_resource(
                self.admin,
                resource_organization_id="org-b",
                owner_user_id="user-9",
            )

    def test_super_admin_requires_explicit_platform_scope_for_cross_tenant_access(self):
        with self.assertRaises(AuthorizationError):
            assert_can_access_resource(
                self.super_admin,
                resource_organization_id="org-a",
                owner_user_id="user-9",
            )

        assert_can_access_resource(
            self.super_admin,
            resource_organization_id="org-a",
            owner_user_id="user-9",
            platform_scope=True,
        )

    def test_admin_can_manage_user_but_not_grant_admin_or_super_admin(self):
        assert_can_manage_user(
            self.admin,
            target_organization_id="org-a",
            target_role=Role.USER,
        )
        with self.assertRaises(AuthorizationError):
            assert_can_manage_user(
                self.admin,
                target_organization_id="org-a",
                target_role=Role.ADMIN,
            )
        with self.assertRaises(AuthorizationError):
            assert_can_manage_user(
                self.admin,
                target_organization_id="org-a",
                target_role=Role.SUPER_ADMIN,
            )

    def test_super_admin_can_manage_any_role_only_with_platform_scope(self):
        with self.assertRaises(AuthorizationError):
            assert_can_manage_user(
                self.super_admin,
                target_organization_id="org-a",
                target_role=Role.ADMIN,
            )
        assert_can_manage_user(
            self.super_admin,
            target_organization_id="org-a",
            target_role=Role.ADMIN,
            platform_scope=True,
        )

    def test_only_super_admin_can_manage_llm_settings(self):
        with self.assertRaises(AuthorizationError):
            assert_can_manage_llm_settings(self.admin)
        with self.assertRaises(AuthorizationError):
            assert_can_manage_llm_settings(self.user)
        assert_can_manage_llm_settings(self.super_admin, platform_scope=True)


if __name__ == "__main__":
    unittest.main()