from __future__ import annotations


class GrantSession:
    def __init__(self, domains):
        self.domains = domains

    def execute(self, _statement, _params):
        return self

    def scalars(self):
        return self

    def all(self):
        return self.domains


def test_viewer_access_context_uses_only_server_side_domain_grants():
    from app.core.knowledge.access import build_access_context

    context = build_access_context(
        GrantSession(["domain-a", "domain-b"]),
        identity={"id": "user-1", "roles": ["viewer"]},
        requested_business_domains=["domain-b", "domain-not-granted"],
        correlation_id="correlation-1",
    )

    assert context.business_domain_uids == frozenset({"domain-b"})
    assert {
        "governance:read",
        "governance:responsibilities:read",
        "rules:read",
        "bi-ai-catalog:read",
    } <= context.permissions


def test_admin_access_context_is_explicitly_global():
    from app.core.knowledge.access import build_access_context

    context = build_access_context(
        GrantSession([]),
        identity={"id": "admin-1", "roles": ["admin"]},
        requested_business_domains=None,
        correlation_id="correlation-2",
    )

    assert context.global_access is True
    assert context.business_domain_uids == frozenset()