import uuid

from app.core.security import create_access_token, hash_password
from app.db.session import SessionLocal
from app.models.membership import Membership
from app.models.user import User
from test_products_inventory import headers, product, workspace


pytest_plugins = ("test_workspace",)


def test_global_search_products_and_staff(
    client,
    verified_user,
):
    data = workspace(
        client,
        verified_user,
        "Global Search",
    )

    business_id = data["business"]["id"]

    created_product = product(
        client,
        verified_user,
        business_id,
        "Global Search Fabric",
        sku="GLOBAL-SEARCH-001",
    ).json()

    response = client.get(
        f"/api/businesses/{business_id}/search",
        params={"q": "GLOBAL-SEARCH"},
        headers=headers(verified_user),
    )

    assert response.status_code == 200

    body = response.json()

    assert body["query"] == "GLOBAL-SEARCH"

    assert any(
        row["resource_type"] == "product"
        and row["id"] == created_product["id"]
        for row in body["results"]
    )

    staff_response = client.get(
        f"/api/businesses/{business_id}/search",
        params={"q": verified_user.email},
        headers=headers(verified_user),
    )

    assert staff_response.status_code == 200

    staff_results = [
        row
        for row in staff_response.json()["results"]
        if row["resource_type"] == "staff"
    ]

    assert staff_results
    assert any(
        verified_user.email in row["secondary"]
        for row in staff_results
    )


def test_global_search_does_not_expose_staff_without_permission(
    client,
    verified_user,
):
    data = workspace(
        client,
        verified_user,
        "Global Search Permissions",
    )

    business_id = data["business"]["id"]

    db = SessionLocal()

    try:
        cashier = User(
            full_name="Global Search Cashier",
            email=f"search-cashier-{uuid.uuid4().hex}@example.test",
            password_hash=hash_password("Password123!"),
            is_email_verified=True,
        )

        db.add(cashier)
        db.flush()

        membership = Membership(
            business_id=uuid.UUID(business_id),
            user_id=cashier.id,
            role="CASHIER",
            all_branches=True,
            is_active=True,
        )

        db.add(membership)
        db.commit()
        db.refresh(cashier)

        cashier_id = cashier.id
    finally:
        db.close()

    cashier_headers = {
        "Authorization": (
            f"Bearer {create_access_token(str(cashier_id))}"
        )
    }

    response = client.get(
        f"/api/businesses/{business_id}/search",
        params={"q": verified_user.email},
        headers=cashier_headers,
    )

    assert response.status_code == 200

    assert all(
        row["resource_type"] != "staff"
        for row in response.json()["results"]
    )

    invalid = client.get(
        f"/api/businesses/{business_id}/search",
        params={"q": "  "},
        headers=headers(verified_user),
    )

    assert invalid.status_code == 422