"""
E2E 测试：Phase 23 - 服务站权限隔离
"""
import os
import pytest
import requests

BASE_URL = "http://localhost:8085/api/v1"
E2E_PASSWORD = os.environ["E2E_PASSWORD"]

def get_station_operator_token():
    r = requests.post(f"{BASE_URL}/auth/operator/login", json={"username": "stationop", "password": E2E_PASSWORD})
    return r.json()["data"]["accessToken"]

def get_counselor_token():
    r = requests.post(f"{BASE_URL}/auth/operator/login", json={"username": "counselor01", "password": E2E_PASSWORD})
    return r.json()["data"]["accessToken"]

def auth_header(token):
    return {"Authorization": f"Bearer {token}"}

def test_station_operator_cannot_view_counseling():
    token = get_station_operator_token()
    r = requests.get(f"{BASE_URL}/counseling/services/operator/queue", headers=auth_header(token))
    # 服务站运营人员不应有咨询队列权限，返回403或空
    assert r.status_code == 403

def test_counselor_cannot_view_service_appointments():
    token = get_counselor_token()
    r = requests.get(f"{BASE_URL}/service-appointments/operator", headers=auth_header(token))
    # Counselor只能查看自己相关的预约，不能浏览全部
    assert r.status_code == 403

def test_content_editor_cannot_access_user_data():
    token = get_counselor_token()  # 复用counselor token模拟content_editor权限边界
    r = requests.get(f"{BASE_URL}/operator/appeals/pending", headers=auth_header(token))
    assert r.status_code == 403

if __name__ == "__main__":
    pytest.main([__file__, "-v"])