import pytest


async def _login(client, username: str) -> str:
    response = await client.post(
        "/api/v1/auth/login",
        data={"username": username, "password": "test-passwort-123"},
    )
    return response.json()["access_token"]


@pytest.mark.asyncio
async def test_admin_only_rejects_mitarbeiter(client, mitarbeiter_user):
    token = await _login(client, "mitarbeiter1")
    response = await client.get(
        "/api/v1/health/admin-only", headers={"Authorization": f"Bearer {token}"}
    )
    assert response.status_code == 403


@pytest.mark.asyncio
async def test_admin_only_allows_administration(client, admin_user):
    token = await _login(client, "admin1")
    response = await client.get(
        "/api/v1/health/admin-only", headers={"Authorization": f"Bearer {token}"}
    )
    assert response.status_code == 200
    assert response.json()["login"] == "admin1"