# authentic2 - versatile identity manager
# Copyright (C) 2010-2019 Entr'ouvert
#
# This program is free software: you can redistribute it and/or modify it
# under the terms of the GNU Affero General Public License as published
# by the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.


import pytest

from authentic2.a2_rbac.models import Role
from authentic2.custom_user.models import User
from authentic2.models import Attribute, Service
from authentic2.utils.misc import ServiceAccessDenied


def test_attribute_disabled(db):
    attribute = Attribute.all_objects.create(name='test', label='test', kind='string')
    user = User.objects.create()
    user.attributes.test = 'abcd'

    assert user.to_json()['test'] == 'abcd'
    attribute.disabled = True
    attribute.save()
    assert 'test' not in user.to_json()

    with pytest.raises(AttributeError):
        assert user.attributes.test == 'abcd'

    with pytest.raises(AttributeError):
        user.attributes.test = '1234'


def test_service_authorize(db):
    service = Service.objects.create(name='foo', slug='foo')
    role = Role.objects.create(name='foo')
    service.authorized_roles.add(role)

    user = User.objects.create()
    with pytest.raises(ServiceAccessDenied):
        service.authorize(user)

    user.is_superuser = True
    user.save()
    assert service.authorize(user)
