import unittest
from unittest.mock import patch
from fastapi import FastAPI
from fastapi.testclient import TestClient
from backend.app.routers import portal


class PortalPrivacyTests(unittest.TestCase):
    def test_detail_and_comments_are_private_for_regular_users(self):
        item = {'id': 1, 'kind': 'issue', 'title': 'Broken movie', 'status': 'new',
                'created_by_username': 'private-reporter', 'created_by_id': 42,
                'assignee_username': 'private-admin', 'metadata_json': '{"email":"secret@example.com"}',
                'description': 'Contact private-reporter or secret@example.com', 'created_at': '2026-09-07'}
        comment = {'id': 1, 'item_id': 1, 'author_username': 'private-admin', 'author_role': 'admin',
                   'message': 'Sent to secret@example.com for private-reporter', 'is_internal': False}
        app = FastAPI()
        app.include_router(portal.router)
        app.dependency_overrides[portal.get_current_user] = lambda: {'username': 'viewer', 'role': 'user'}
        with patch.object(portal, 'get_portal_item', return_value=item), \
             patch.object(portal, '_list_portal_comments', return_value=[comment]), \
             patch.object(portal, 'list_portal_item_activity', return_value=[]), \
             patch.object(portal, 'issue_resolution_state', return_value={}), \
             patch.object(portal, 'get_all_users', return_value=[{'username': 'private-reporter', 'email': 'secret@example.com'}, {'username': 'private-admin'}]):
            client = TestClient(app)
            for path in ['/portal/items/1', '/portal/items/1/comments']:
                response = client.get(path)
                self.assertEqual(response.status_code, 200)
                for secret in ['private-reporter', 'private-admin', 'secret@example.com', 'metadata_json', 'assignee_username', 'created_by_id']:
                    self.assertNotIn(secret, response.text)
            admin_result = portal._serialize_item(item, {'username': 'admin', 'role': 'admin'})
            self.assertEqual(admin_result['created_by_username'], 'private-reporter')
            own_result = portal._serialize_item(item, {'username': 'private-reporter', 'role': 'user'})
            self.assertTrue(own_result['permissions']['can_edit'])