MABEA/backend/tests/test_stammdaten.py

import pytest

from tests.conftest import auth_header, login


@pytest.mark.asyncio
async def test_admin_can_create_bereich(client, admin_user):
    token = await login(client, "admin1")
    response = await client.post(
        "/api/v1/bereiche", json={"name": "Rettungsdienst"}, headers=auth_header(token)
    )
    assert response.status_code == 201
    assert response.json()["name"] == "Rettungsdienst"


@pytest.mark.asyncio
async def test_mitarbeiter_cannot_create_bereich(client, mitarbeiter_user):
    token = await login(client, "mitarbeiter1")
    response = await client.post(
        "/api/v1/bereiche", json={"name": "Rettungsdienst"}, headers=auth_header(token)
    )
    assert response.status_code == 403


@pytest.mark.asyncio
async def test_mitarbeiter_can_list_bereiche(client, mitarbeiter_user, admin_user, db_session):
    from app.models.stammdaten import Bereich

    db_session.add(Bereich(name="KatS"))
    await db_session.flush()

    token = await login(client, "mitarbeiter1")
    response = await client.get("/api/v1/bereiche", headers=auth_header(token))
    assert response.status_code == 200
    assert any(b["name"] == "KatS" for b in response.json())


@pytest.mark.asyncio
async def test_material_lifecycle(client, admin_user):
    token = await login(client, "admin1")
    create_response = await client.post(
        "/api/v1/materialien",
        json={"name": "Kompresse steril", "einheit": "Stück", "materialtyp": "standard"},
        headers=auth_header(token),
    )
    assert create_response.status_code == 201
    material_id = create_response.json()["id"]

    patch_response = await client.patch(
        f"/api/v1/materialien/{material_id}",
        json={"aktiv": False},
        headers=auth_header(token),
    )
    assert patch_response.status_code == 200
    assert patch_response.json()["aktiv"] is False


@pytest.mark.asyncio
async def test_material_not_found(client, admin_user):
    token = await login(client, "admin1")
    response = await client.get("/api/v1/materialien/999999", headers=auth_header(token))
    assert response.status_code == 404


@pytest.mark.asyncio
async def test_admin_can_update_bereich(client, admin_user):
    token = await login(client, "admin1")
    erstellt = await client.post("/api/v1/bereiche", json={"name": "Alt"}, headers=auth_header(token))
    bereich_id = erstellt.json()["id"]

    response = await client.patch(
        f"/api/v1/bereiche/{bereich_id}", json={"name": "Neu"}, headers=auth_header(token)
    )
    assert response.status_code == 200
    assert response.json()["name"] == "Neu"


@pytest.mark.asyncio
async def test_admin_can_update_kategorie(client, admin_user):
    token = await login(client, "admin1")
    bereich = await client.post("/api/v1/bereiche", json={"name": "B"}, headers=auth_header(token))
    erstellt = await client.post(
        "/api/v1/kategorien",
        json={"bereich_id": bereich.json()["id"], "name": "Alt"},
        headers=auth_header(token),
    )
    kategorie_id = erstellt.json()["id"]

    response = await client.patch(
        f"/api/v1/kategorien/{kategorie_id}", json={"name": "Neu"}, headers=auth_header(token)
    )
    assert response.status_code == 200
    assert response.json()["name"] == "Neu"


@pytest.mark.asyncio
async def test_admin_can_update_standort(client, admin_user):
    token = await login(client, "admin1")
    erstellt = await client.post("/api/v1/standorte", json={"name": "Alt"}, headers=auth_header(token))
    standort_id = erstellt.json()["id"]

    response = await client.patch(
        f"/api/v1/standorte/{standort_id}", json={"name": "Neu"}, headers=auth_header(token)
    )
    assert response.status_code == 200
    assert response.json()["name"] == "Neu"


@pytest.mark.asyncio
async def test_admin_can_update_objekttyp(client, admin_user):
    token = await login(client, "admin1")
    bereich = await client.post("/api/v1/bereiche", json={"name": "B"}, headers=auth_header(token))
    erstellt = await client.post(
        "/api/v1/objekttypen",
        json={"bereich_id": bereich.json()["id"], "name": "Alt"},
        headers=auth_header(token),
    )
    objekttyp_id = erstellt.json()["id"]

    response = await client.patch(
        f"/api/v1/objekttypen/{objekttyp_id}", json={"name": "Neu"}, headers=auth_header(token)
    )
    assert response.status_code == 200
    assert response.json()["name"] == "Neu"


@pytest.mark.asyncio
async def test_fach_lifecycle(client, admin_user):
    """Nutzer-Vorgabe: feste Fächer-Liste je Objekttyp."""
    token = await login(client, "admin1")
    bereich = await client.post("/api/v1/bereiche", json={"name": "B"}, headers=auth_header(token))
    objekttyp = await client.post(
        "/api/v1/objekttypen",
        json={"bereich_id": bereich.json()["id"], "name": "Rucksack"},
        headers=auth_header(token),
    )
    objekttyp_id = objekttyp.json()["id"]

    erstellt = await client.post(
        "/api/v1/faecher",
        json={"objekttyp_id": objekttyp_id, "name": "Fach 1", "sortierung": 1},
        headers=auth_header(token),
    )
    assert erstellt.status_code == 201
    fach_id = erstellt.json()["id"]

    liste = await client.get("/api/v1/faecher", headers=auth_header(token))
    assert any(f["id"] == fach_id for f in liste.json())

    patch_response = await client.patch(
        f"/api/v1/faecher/{fach_id}", json={"name": "Fach 1 links"}, headers=auth_header(token)
    )
    assert patch_response.status_code == 200
    assert patch_response.json()["name"] == "Fach 1 links"

    delete_response = await client.delete(f"/api/v1/faecher/{fach_id}", headers=auth_header(token))
    assert delete_response.status_code == 204

    liste_nach_delete = await client.get("/api/v1/faecher", headers=auth_header(token))
    assert not any(f["id"] == fach_id for f in liste_nach_delete.json())


@pytest.mark.asyncio
async def test_mitarbeiter_cannot_create_fach(client, mitarbeiter_user, admin_user, db_session):
    from app.models.stammdaten import Bereich, Objekttyp

    bereich = Bereich(name="B2")
    db_session.add(bereich)
    await db_session.flush()
    objekttyp = Objekttyp(bereich_id=bereich.id, name="Rucksack2")
    db_session.add(objekttyp)
    await db_session.flush()

    token = await login(client, "mitarbeiter1")
    response = await client.post(
        "/api/v1/faecher",
        json={"objekttyp_id": objekttyp.id, "name": "Fach X"},
        headers=auth_header(token),
    )
    assert response.status_code == 403