"""Visibility and access-control rules."""

from __future__ import annotations

import pytest
from django.contrib.auth.models import AnonymousUser

from apps.repository.documents import services
from apps.repository.documents.models import Document
from apps.repository.documents.permissions import can_access, can_download


@pytest.mark.django_db
def test_anonymous_can_access_open_access_only(submitter_user, manager_user, public_collection, restricted_collection, sample_pdf):
    open_doc = services.ingest_document(
        file=sample_pdf,
        title="Open doc",
        collection=public_collection,
        document_type=Document.DocumentType.THESIS,
        abstract="x",
        submitted_by=submitter_user,
        actor=submitter_user,
    )
    services.submit_for_qa(open_doc, actor=submitter_user)
    services.decide_qa(open_doc.qa_records.first(), decision="approve", actor=manager_user, checklist=services.full_qa_checklist())

    pdf2 = sample_pdf
    pdf2.seek(0)
    pdf2_bytes = pdf2.read()
    from django.core.files.base import ContentFile

    restricted_pdf = ContentFile(pdf2_bytes + b"\n", name="restricted.pdf")
    restricted_doc = services.ingest_document(
        file=restricted_pdf,
        title="Restricted doc",
        collection=restricted_collection,
        document_type=Document.DocumentType.PROJECT_REPORT,
        abstract="y",
        submitted_by=submitter_user,
        actor=submitter_user,
    )
    services.submit_for_qa(restricted_doc, actor=submitter_user)
    services.decide_qa(restricted_doc.qa_records.first(), decision="approve", actor=manager_user, checklist=services.full_qa_checklist())

    anon = AnonymousUser()
    assert can_access(anon, open_doc) is True
    assert can_access(anon, restricted_doc) is False
    assert can_download(anon, open_doc) is True
    assert can_download(anon, restricted_doc) is False


@pytest.mark.django_db
def test_for_user_queryset_excludes_internal(submitter_user, public_collection, sample_pdf):
    services.ingest_document(
        file=sample_pdf,
        title="Visible",
        collection=public_collection,
        document_type=Document.DocumentType.THESIS,
        abstract="x",
        submitted_by=submitter_user,
        actor=submitter_user,
    )
    qs = Document.objects.for_user(AnonymousUser())
    # Anonymous sees no DRAFT documents.
    assert qs.count() == 0