"""
婚恋咨询权限 E2E（INV-012 只能访问分配的咨询 / INV-013 红娘不能读咨询正文）。

关键设计：**先证明本人能读到正文**，再证明他人读不到。
只断言"他人读不到"会被"全局脱敏/接口全量报错"轻易蒙混过关——
那证明的不是 INV-013，而是接口坏了。
"""
import pytest

pytestmark = pytest.mark.e2e

SENSITIVE = "SENSITIVE-BODY-MARKER"


def _create_counseling(api, token: str) -> str:
    data = api.ok(
        "POST",
        "/counseling/services",
        token=token,
        json={
            "serviceType": "relationship_guidance",
            "requestSource": "user_self",
            "userRequestSummary": SENSITIVE,
            "preferredServiceMode": "online",
            "preferredTime": "morning",
        },
    )
    assert data["status"] == "pending", f"咨询初始状态异常：{data}"
    return data["id"]


def test_owner_can_read_own_request_summary(api, user_token):
    """反证：接口确实会返回正文，"读不到"才可能是权限生效而非接口失效。"""
    service_id = _create_counseling(api, user_token)
    data = api.ok("GET", f"/counseling/services/{service_id}", token=user_token)
    assert data["userRequestSummary"] == SENSITIVE, f"本人竟读不到自己的咨询正文：{data}"


def test_matchmaker_has_no_counseling_view(api, user_token, operator_token):
    """INV-013：红娘不具备 counseling.service.view，读取咨询详情必须被拒。"""
    service_id = _create_counseling(api, user_token)
    resp = api.call(
        "GET",
        f"/counseling/services/operator/{service_id}",
        token=operator_token("e2e_matchmaker"),
    )
    assert resp.status_code == 403, (
        f"红娘竟被允许访问咨询详情：HTTP {resp.status_code} {resp.text[:200]}"
    )
    assert SENSITIVE not in resp.text, "响应体泄漏了咨询正文"


def test_counselor_cannot_read_unassigned_service(api, user_token, operator_token):
    """INV-012：咨询师只能访问明确分配给自己的服务。"""
    service_id = _create_counseling(api, user_token)
    resp = api.call(
        "GET",
        f"/counseling/services/operator/{service_id}",
        token=operator_token("e2e_counselor"),
    )
    body = resp.json()
    assert body.get("success") is False, f"未分配的咨询竟被咨询师读到：{body}"
    assert SENSITIVE not in resp.text, "响应体泄漏了咨询正文"


def test_non_uuid_service_id_is_rejected_not_500(api, user_token):
    """
    非 UUID 的 path 参数应被判为 400，而不是打到数据库抛出
    `operator does not exist: uuid = character varying` 变成 500。
    """
    resp = api.call("GET", "/counseling/services/not-a-uuid", token=user_token)
    assert resp.status_code != 500, (
        f"非法 ID 触发了 500（数据库类型异常外泄）：HTTP {resp.status_code}"
    )
    assert 400 <= resp.status_code < 500, f"非法 ID 应返回 4xx，实际 {resp.status_code}"