"""Role-gate regression tests for the v1 MEL API.

PRD §5.3 — Indicator/LogFrame/DataPoint endpoints expose programme-level M&E
data and must be gated to officer + programme-management roles. Previously
every authenticated user (applicant, learner, alumni) could read all rows.
"""
from __future__ import annotations

import pytest

LOGFRAMES_URL = "/api/v1/mel/logframes/"
INDICATORS_URL = "/api/v1/mel/indicators/"
TARGETS_URL = "/api/v1/mel/targets/"
DATAPOINTS_URL = "/api/v1/mel/data-points/"


@pytest.mark.django_db
@pytest.mark.parametrize("url", [LOGFRAMES_URL, INDICATORS_URL, TARGETS_URL, DATAPOINTS_URL])
def test_anonymous_blocked(api_client, url):
    resp = api_client.get(url)
    assert resp.status_code in (401, 403)


@pytest.mark.django_db
@pytest.mark.parametrize("url", [LOGFRAMES_URL, INDICATORS_URL, TARGETS_URL, DATAPOINTS_URL])
def test_learner_blocked(api_client, learner_user, url):
    """Learners (and other non-MEL roles) must not read MEL data."""
    api_client.force_authenticate(learner_user)
    resp = api_client.get(url)
    assert resp.status_code == 403


@pytest.mark.django_db
@pytest.mark.parametrize("url", [LOGFRAMES_URL, INDICATORS_URL, TARGETS_URL, DATAPOINTS_URL])
def test_applicant_blocked(api_client, applicant_a, url):
    api_client.force_authenticate(applicant_a)
    resp = api_client.get(url)
    assert resp.status_code == 403


@pytest.mark.django_db
@pytest.mark.parametrize("url", [LOGFRAMES_URL, INDICATORS_URL, TARGETS_URL, DATAPOINTS_URL])
def test_mel_officer_allowed(api_client, mel_officer, url):
    api_client.force_authenticate(mel_officer)
    resp = api_client.get(url)
    assert resp.status_code == 200


@pytest.mark.django_db
@pytest.mark.parametrize("url", [LOGFRAMES_URL, INDICATORS_URL, TARGETS_URL, DATAPOINTS_URL])
def test_grants_manager_allowed(api_client, grants_manager_a, url):
    api_client.force_authenticate(grants_manager_a)
    resp = api_client.get(url)
    assert resp.status_code == 200


@pytest.mark.django_db
@pytest.mark.parametrize("url", [LOGFRAMES_URL, INDICATORS_URL, TARGETS_URL, DATAPOINTS_URL])
def test_admin_allowed(api_client, admin_user, url):
    api_client.force_authenticate(admin_user)
    resp = api_client.get(url)
    assert resp.status_code == 200