#!/usr/bin/env python
"""
Comprehensive test script to verify all permissions are enforced correctly
Tests that permissions actually control access to features
"""
import os
import sys
import django

# Setup Django
sys.path.append(os.path.dirname(os.path.abspath(__file__)))
os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'branch_system.settings')
django.setup()

from django.contrib.auth import get_user_model
from users.models import CustomUser, UserPermission, RolePermission, DefaultRolePermission
from django.db import transaction

CustomUser = get_user_model()

def test_permission_enforcement():
    """Test that permissions actually prevent access"""
    print("=" * 80)
    print("PERMISSION ENFORCEMENT TEST")
    print("=" * 80)
    
    # Create a test staff user
    print("\n1. Creating test staff user...")
    try:
        test_user = CustomUser.objects.get(email='test_staff_permissions@test.com')
        print(f"   Using existing user: {test_user.get_full_name()}")
    except CustomUser.DoesNotExist:
        test_user = CustomUser.objects.create_user(
            username='test_staff_permissions',
            email='test_staff_permissions@test.com',
            password='testpass123',
            first_name='Test',
            last_name='Staff',
            role='loan_officer',
            is_staff=True,
            phone_number='+254712345678'  # Add phone number to avoid unique constraint
        )
        print(f"   Created user: {test_user.get_full_name()}")
    
    # Test 1: Client Create Permission
    print("\n2. Testing Client Create Permission...")
    
    # Remove all custom permissions
    UserPermission.objects.filter(user=test_user, module='clients', action='create').delete()
    
    # Test without permission
    has_create = test_user.has_permission('clients', 'create')
    print(f"   Client create permission (should be False): {has_create}")
    assert not has_create, "ERROR: User should NOT have client create permission!"
    
    # Grant permission
    UserPermission.objects.create(
        user=test_user,
        module='clients',
        action='create',
        is_allowed=True,
        granted_by=CustomUser.objects.filter(role='admin').first()
    )
    
    # Test with permission
    has_create = test_user.has_permission('clients', 'create')
    print(f"   Client create permission (should be True): {has_create}")
    assert has_create, "ERROR: User should have client create permission!"
    
    # Revoke permission
    UserPermission.objects.filter(user=test_user, module='clients', action='create').update(is_allowed=False)
    has_create = test_user.has_permission('clients', 'create')
    print(f"   Client create permission after revoke (should be False): {has_create}")
    assert not has_create, "ERROR: User should NOT have client create permission after revoke!"
    
    # Test 2: Client Edit Permission
    print("\n3. Testing Client Edit Permission...")
    UserPermission.objects.filter(user=test_user, module='clients', action='edit').delete()
    has_edit = test_user.has_permission('clients', 'edit')
    print(f"   Client edit permission (should be False): {has_edit}")
    assert not has_edit, "ERROR: User should NOT have client edit permission!"
    
    # Test 3: Client Delete Permission
    print("\n4. Testing Client Delete Permission...")
    UserPermission.objects.filter(user=test_user, module='clients', action='delete').delete()
    has_delete = test_user.has_permission('clients', 'delete')
    print(f"   Client delete permission (should be False): {has_delete}")
    assert not has_delete, "ERROR: User should NOT have client delete permission!"
    
    # Test 4: Loan Create Permission
    print("\n5. Testing Loan Create Permission...")
    UserPermission.objects.filter(user=test_user, module='loans', action='create').delete()
    has_loan_create = test_user.has_permission('loans', 'create')
    print(f"   Loan create permission (should be False): {has_loan_create}")
    assert not has_loan_create, "ERROR: User should NOT have loan create permission!"
    
    # Test 5: Loan Approve Permission
    print("\n6. Testing Loan Approve Permission...")
    UserPermission.objects.filter(user=test_user, module='loans', action='approve').delete()
    has_loan_approve = test_user.has_permission('loans', 'approve')
    print(f"   Loan approve permission (should be False): {has_loan_approve}")
    assert not has_loan_approve, "ERROR: User should NOT have loan approve permission!"
    
    # Test 6: Test all SIMPLIFIED_PERMISSIONS
    print("\n7. Testing All Simplified Permissions...")
    from users.simplified_permissions_views import SIMPLIFIED_PERMISSIONS, get_module_code
    
    failed_permissions = []
    for module_name, actions in SIMPLIFIED_PERMISSIONS.items():
        module_code = get_module_code(module_name)
        for action_code, action_description in actions.items():
            # Clear permission
            UserPermission.objects.filter(user=test_user, module=module_code, action=action_code).delete()
            
            # Check it's denied
            has_perm = test_user.has_permission(module_code, action_code)
            if has_perm:
                # Check if it's from role default
                try:
                    role_perm = RolePermission.objects.get(
                        role=test_user.role,
                        module=module_code,
                        action=action_code
                    )
                    if role_perm.is_allowed:
                        # This is OK - role default allows it
                        pass
                    else:
                        failed_permissions.append(f"{module_code}.{action_code} - should be denied but role default allows")
                except RolePermission.DoesNotExist:
                    try:
                        default_perm = DefaultRolePermission.objects.get(
                            role=test_user.role,
                            module=module_code,
                            action=action_code
                        )
                        if default_perm.is_allowed:
                            # This is OK - default allows it
                            pass
                        else:
                            failed_permissions.append(f"{module_code}.{action_code} - should be denied but default allows")
                    except DefaultRolePermission.DoesNotExist:
                        # No default, should be denied
                        failed_permissions.append(f"{module_code}.{action_code} - should be denied but returned True")
            
            # Grant permission and verify
            UserPermission.objects.update_or_create(
                user=test_user,
                module=module_code,
                action=action_code,
                defaults={'is_allowed': True, 'granted_by': CustomUser.objects.filter(role='admin').first()}
            )
            has_perm = test_user.has_permission(module_code, action_code)
            if not has_perm:
                failed_permissions.append(f"{module_code}.{action_code} - should be allowed but returned False")
    
    if failed_permissions:
        print(f"\n   FAILED: {len(failed_permissions)} permissions not working correctly:")
        for perm in failed_permissions[:10]:
            print(f"     - {perm}")
        if len(failed_permissions) > 10:
            print(f"     ... and {len(failed_permissions) - 10} more")
    else:
        print("   All permissions working correctly!")
    
    print("\n" + "=" * 80)
    print("TEST SUMMARY")
    print("=" * 80)
    print(f"Total permissions tested: {sum(len(actions) for actions in SIMPLIFIED_PERMISSIONS.values())}")
    print(f"Failed permissions: {len(failed_permissions)}")
    
    if failed_permissions:
        print("\nACTION REQUIRED: Fix the failed permissions above")
        return False
    else:
        print("\nSUCCESS: All permissions are working correctly!")
        return True

if __name__ == '__main__':
    success = test_permission_enforcement()
    sys.exit(0 if success else 1)

