"""LDAP config tests — Go/Gin backend (admin only)."""
import pytest
from httpx import AsyncClient
from tests.conftest import auth_header


class TestLDAPConfig:
    async def test_get_config(self, client: AsyncClient, admin_token: str):
        resp = await client.get("/api/v1/ldap-config", headers=auth_header(admin_token))
        assert resp.status_code == 200
        data = resp.json()
        assert "ldap_host" in data
        assert "ldap_port" in data

    async def test_update_config(self, client: AsyncClient, admin_token: str):
        resp = await client.put("/api/v1/ldap-config", headers=auth_header(admin_token), json={
            "ldap_host": "8.217.205.92",
            "ldap_port": 389,
            "admin_dn": "cn=admin,dc=opsx,dc=vip",
            "admin_password": "admin123",
            "base_dn": "dc=opsx,dc=vip",
            "use_ldaps": False,
        })
        assert resp.status_code == 200

    async def test_developer_forbidden(self, client: AsyncClient, developer_token: str):
        resp = await client.get("/api/v1/ldap-config", headers=auth_header(developer_token))
        assert resp.status_code == 403

    async def test_no_auth(self, client: AsyncClient):
        resp = await client.get("/api/v1/ldap-config")
        assert resp.status_code == 401