from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]


def test_rbac_migration_preserves_legacy_accounts_and_seeds_fixed_roles():
    migration = (
        ROOT / "migrations/versions/20260716_10_rbac.py"
    ).read_text(encoding="utf-8")

    assert "users_legacy" in migration
    assert "DROP TABLE" not in migration.upper()
    assert "password_hash" in migration
    assert "password VARCHAR" not in migration
    assert "ON DELETE CASCADE" in migration
    for role in ("admin", "editor", "viewer"):
        assert role in migration


def test_rbac_models_never_define_reversible_password_column():
    models = (ROOT / "app/core/system/models.py").read_text(encoding="utf-8")

    assert "password_hash" in models
    assert "password =" not in models
    assert "class User" in models
    assert "class Role" in models