"""Audit rules read-only tests — Go/Gin backend.
Go backend only has GET /audit-rules (list), no CRUD."""
import pytest
from httpx import AsyncClient
from tests.conftest import auth_header


class TestListAuditRules:
    async def test_list_rules(self, client: AsyncClient, admin_token: str):
        resp = await client.get("/api/v1/audit-rules", headers=auth_header(admin_token))
        assert resp.status_code == 200
        data = resp.json()
        assert isinstance(data, list)
        assert len(data) > 0

    async def test_list_rules_has_required_fields(self, client: AsyncClient, admin_token: str):
        resp = await client.get("/api/v1/audit-rules", headers=auth_header(admin_token))
        data = resp.json()
        if data:
            rule = data[0]
            assert "id" in rule
            assert "name" in rule
            assert "rule_type" in rule
            assert "severity" in rule
            assert "db_type" in rule
            assert "is_enabled" in rule

    async def test_filter_db_type(self, client: AsyncClient, admin_token: str):
        """Go backend does not support server-side filter, verify data has db_type field."""
        resp = await client.get("/api/v1/audit-rules", headers=auth_header(admin_token))
        assert resp.status_code == 200
        data = resp.json()
        mysql_rules = [r for r in data if r["db_type"] == "mysql"]
        assert len(mysql_rules) > 0, "Should have at least one mysql rule"

    async def test_filter_rule_type(self, client: AsyncClient, admin_token: str):
        """Go backend does not support server-side filter, verify rule_type field exists."""
        resp = await client.get("/api/v1/audit-rules", headers=auth_header(admin_token))
        assert resp.status_code == 200
        data = resp.json()
        ddl_rules = [r for r in data if r["rule_type"] == "DDL"]
        assert len(ddl_rules) > 0, "Should have at least one DDL rule"

    async def test_no_auth(self, client: AsyncClient):
        resp = await client.get("/api/v1/audit-rules")
        assert resp.status_code == 401

    async def test_all_users_can_list(self, client: AsyncClient, admin_token: str, developer_token: str):
        """audit-rules is under auth group (no role restriction), all authenticated users can access."""
        resp = await client.get("/api/v1/audit-rules", headers=auth_header(admin_token))
        assert resp.status_code == 200
        resp2 = await client.get("/api/v1/audit-rules", headers=auth_header(developer_token))
        assert resp2.status_code == 200