# backend/core/users/tests/test_permissions.py

import pytest
from rest_framework import status
from rest_framework.test import APIClient
from django.contrib.auth import get_user_model

User = get_user_model()

@pytest.mark.django_db
class TestUserPermissions:

    def setup_method(self):
        self.client = APIClient()
        # Kreiramo dva korisnika
        self.user1 = User.objects.create_user(email="user1@erp.hr", password="password123")
        self.user2 = User.objects.create_user(email="user2@erp.hr", password="password123")

    def test_user_cannot_edit_other_user(self):
        """Osigurava da user1 ne može mijenjati podatke od user2."""
        self.client.force_authenticate(user=self.user1)
        
        # Pokušavamo patchati user2 (pretpostavljamo URL /api/users/{id}/)
        response = self.client.patch(f'/api/users/{self.user2.id}/', {"first_name": "Haker"})
        
        # Trebali bismo dobiti 403 Forbidden ili 404 (ovisno kako skrivaš postojanje drugih)
        assert response.status_code in [status.HTTP_403_FORBIDDEN, status.HTTP_404_NOT_FOUND]

    def test_authenticated_user_can_edit_self(self):
        """Osigurava da user1 može mijenjati svoje podatke."""
        self.client.force_authenticate(user=self.user1)
        
        response = self.client.patch(f'/api/users/{self.user1.id}/', {"first_name": "Ime"})
        
        assert response.status_code == status.HTTP_200_OK
        self.user1.refresh_from_db()
        assert self.user1.first_name == "Ime"