from unittest.mock import patch

from app.modules.admin.service import patch_user
from app.modules.users import repository
from app.modules.users.repository import create_user, get_user_by_email
from app.core.security import hash_password


def test_admin_cannot_self_demote():
    admin = get_user_by_email("admin@compton.example")
    try:
        patch_user(admin, admin.id, "user", None)
        assert False, "Expected self-demotion error"
    except ValueError as exc:
        assert str(exc) == "SELF_DEMOTION_FORBIDDEN"


def test_admin_can_promote_user():
    admin = get_user_by_email("admin@compton.example")
    regular = create_user("sample@example.com", hash_password("Valid123"), role="user", status="active")
    result = patch_user(admin, regular.id, "admin", None)
    assert result["role"] == "admin"


def test_last_admin_protected():
    admin = get_user_by_email("admin@compton.example")
    target = create_user("target@example.com", hash_password("Valid123"), role="admin", status="active")
    with patch.object(repository, "count_admins", return_value=1):
        try:
            patch_user(admin, target.id, "user", None)
            assert False, "Expected last-admin protection"
        except ValueError as exc:
            assert str(exc) == "LAST_ADMIN_PROTECTED"