from django.contrib.auth.models import AnonymousUser

from intent.access import org_access
from intent.orgs.models import OrgMembership


def test_owner_access(owner, org):
    access = org_access(owner, org)
    assert access.is_owner
    assert access.can_view_members
    assert access.can_manage_members
    assert access.can_create_projects


def test_collaborator_access(collaborator, org):
    access = org_access(collaborator, org)
    assert access.is_member
    assert not access.is_owner
    assert access.can_view_members
    assert not access.can_manage_members
    assert not access.can_create_projects


def test_collaborator_with_grant_can_create_projects(collaborator, org):
    OrgMembership.objects.filter(user=collaborator).update(can_create_projects=True)
    assert org_access(collaborator, org).can_create_projects


def test_outsiders_have_no_access(make_user, org):
    for user in [AnonymousUser(), make_user()]:
        access = org_access(user, org)
        assert not access.is_member
        assert not access.can_view_members
        assert not access.can_create_projects


def test_staff_never_have_access_even_with_a_membership_row(make_user, org):
    admin = make_user(is_staff=True)
    # Bypasses the service checks to prove access.py doesn't rely on them alone.
    OrgMembership.objects.create(org=org, user=admin, role="owner")
    assert not org_access(admin, org).is_member