"""Tests for the feedback workflow realignment (Inquiry department-ownership)."""
from django.contrib.auth.models import Group

import pytest
from django.test import TestCase
from django.urls import reverse

from apps.accounts.models import User
from apps.organizations.models import Department, Hospital
from apps.complaints.models import Inquiry


def _ensure_group(name):
    """Get or create a role group (pytest runs with --nomigrations, so seeded
    groups may not exist in the test DB — mirrors the pattern in
    tests_routing_rejection.py and tests_workflow_fixes.py)."""
    grp, _ = Group.objects.get_or_create(name=name)
    return grp


@pytest.mark.django_db
class TestInquiryDepartmentResponsePermission(TestCase):
    """A department manager of the handling department can record a response.

    Uses self.client (full middleware incl. django.contrib.messages) rather
    than calling the view directly with RequestFactory, because the view
    calls messages.error() on the permission-denied path.
    """

    def setUp(self):
        self.hospital = Hospital.objects.create(name="Test Hospital", code="TH01")
        self.dept = Department.objects.create(name="Dept A", hospital=self.hospital, code="DA")
        self.other_dept = Department.objects.create(name="Dept B", hospital=self.hospital, code="DB")

        _ensure_group("Department Manager")
        self.dept_manager = User.objects.create_user(
            username="dmgr", email="dmgr@test", password="x", department=self.dept
        )
        self.dept_manager.groups.add(Group.objects.get(name="Department Manager"))

        self.other_manager = User.objects.create_user(
            username="other_dmgr", email="o@test", password="x", department=self.other_dept
        )
        self.other_manager.groups.add(Group.objects.get(name="Department Manager"))

        self.inquiry = Inquiry.objects.create(
            hospital=self.hospital,
            department=self.dept,
            subject="Test",
            message="msg",
            status="in_progress",
            sent_to_department=True,
        )

    def test_dept_manager_of_handling_dept_can_access_response_view(self):
        """GET to inquiry_department_response succeeds (200) for dept manager of handling dept."""
        self.client.force_login(self.dept_manager)
        response = self.client.get(
            reverse("inquiries:inquiry_department_response", kwargs={"pk": self.inquiry.pk})
        )
        # 200 = permission granted, 302 = permission denied redirect.
        assert response.status_code == 200, \
            f"dept_manager of handling dept should be allowed, got {response.status_code}"

    def test_dept_manager_of_other_dept_cannot_access(self):
        """Dept manager of a non-handling department is denied (302 redirect)."""
        self.client.force_login(self.other_manager)
        response = self.client.get(
            reverse("inquiries:inquiry_department_response", kwargs={"pk": self.inquiry.pk})
        )
        assert response.status_code == 302, \
            f"dept_manager of other dept should be redirected (denied), got {response.status_code}"