"""Settings › Users keeps someone able to get back in (#5336): nobody can
disable, demote or delete their own account, and the last active admin
cannot be demoted or disabled."""
from steward.models.users import User, UserRole
from steward.settings.users import password_problem, refusal


def _u(uid, role=UserRole.admin, active=True):
    return User(id=uid, username=uid, email=f"{uid}@t", password_hash="x", role=role, is_active=active)


def test_nobody_changes_their_own_access():
    me = _u("me")
    for change in ("demote", "disable", "delete"):
        assert "own" in refusal(change, me, "me", active_admins=5)


def test_the_last_active_admin_stays():
    only = _u("only")
    assert "only active admin" in refusal("demote", only, "someone-else", active_admins=1)
    assert refusal("demote", only, "someone-else", active_admins=2) is None
    assert refusal("disable", _u("v", role=UserRole.viewer), "me", active_admins=1) is None
    assert refusal("delete", _u("gone", active=False), "me", active_admins=1) is None


def test_a_password_is_long_enough_and_typed_twice():
    assert "at least" in password_problem("short", "short")
    assert "match" in password_problem("long enough", "long enougj")
    assert password_problem("long enough", "long enough") is None