jorgasisten

from pathlib import Path
from types import SimpleNamespace

from jorgasisten.services.access_control import (
    ROLE_ADMIN,
    ROLE_GUEST,
    ROLE_OPERATOR,
    ROLE_VIEWER,
    AccessControlService,
    extract_password_candidate,
    is_explicit_access_attempt,
)


def settings_for_access(path: Path) -> SimpleNamespace:
    return SimpleNamespace(
        admin_ids={999},
        operator_access_password="operator-rahasia",
        viewer_access_password="viewer-rahasia",
        user_access_registry_path=str(path),
    )


def test_access_control_authenticates_operator_and_persists_session(tmp_path: Path) -> None:
    service = AccessControlService(settings_for_access(tmp_path / "user_access.json"))

    role = service.authenticate(123, "operator-rahasia")

    assert role == ROLE_OPERATOR
    assert service.get_role(123) == ROLE_OPERATOR
    assert service.get_session(123) is not None


def test_access_control_uses_admin_ids_without_password(tmp_path: Path) -> None:
    service = AccessControlService(settings_for_access(tmp_path / "user_access.json"))

    assert service.get_role(999) == ROLE_ADMIN


def test_access_control_rejects_unknown_password(tmp_path: Path) -> None:
    service = AccessControlService(settings_for_access(tmp_path / "user_access.json"))

    role = service.authenticate(123, "salah")

    assert role == ROLE_GUEST
    assert service.get_role(123) == ROLE_GUEST


def test_access_control_logout_clears_non_admin_session(tmp_path: Path) -> None:
    service = AccessControlService(settings_for_access(tmp_path / "user_access.json"))
    service.authenticate(123, "viewer-rahasia")

    service.logout(123)

    assert service.get_role(123) == ROLE_GUEST
    assert service.get_session(123) is None
    assert service.authenticate(123, "viewer-rahasia") == ROLE_VIEWER


def test_extract_password_candidate_accepts_login_hints() -> None:
    assert extract_password_candidate("operator-rahasia") == "operator-rahasia"
    assert extract_password_candidate("password akses: operator-rahasia") == "operator-rahasia"
    assert extract_password_candidate("login operator-rahasia") == "operator-rahasia"
    assert extract_password_candidate("/login operator-rahasia") == "operator-rahasia"


def test_is_explicit_access_attempt_detects_password_or_login_hint(tmp_path: Path) -> None:
    settings = settings_for_access(tmp_path / "user_access.json")

    assert is_explicit_access_attempt("operator-rahasia", settings) is True
    assert is_explicit_access_attempt("login operator-rahasia", settings) is True
    assert is_explicit_access_attempt("halo bot", settings) is False