"""The colleague directory: member-visible, permission-safe, no credentials."""

from httpx import AsyncClient
from sqlalchemy.ext.asyncio import AsyncSession

from app.models import User


async def _login(client: AsyncClient, email: str = "pablo@test.dev") -> None:
    response = await client.post(
        "/api/auth/login", json={"email": email, "password": "secret123"}
    )
    assert response.status_code == 200


async def test_directory_lists_colleagues_without_leaking_credentials(
    client: AsyncClient, seeded_user: User, seeded_admin: User
) -> None:
    await _login(client)
    people = (await client.get("/api/people")).json()
    names = {person["name"] for person in people}
    assert {"Pablo Test", "Florian Test"} <= names
    # No email or password ever leaves the directory.
    assert all("email" not in p and "password_hash" not in p for p in people)

    pablo = next(p for p in people if p["name"] == "Pablo Test")
    assert pablo["department"] == "Engineering"
    assert pablo["role"] == "member"


async def test_directory_requires_a_session(client: AsyncClient) -> None:
    assert (await client.get("/api/people")).status_code == 401


async def test_person_detail_and_unknown_is_404(
    client: AsyncClient, db: AsyncSession, seeded_user: User
) -> None:
    await _login(client)
    ok = await client.get(f"/api/people/{seeded_user.id}")
    assert ok.status_code == 200
    assert ok.json()["name"] == "Pablo Test"

    missing = await client.get("/api/people/00000000-0000-0000-0000-000000000000")
    assert missing.status_code == 404