"""Service group operations must never reach platform IAM groups."""
import unittest
from unittest.mock import Mock

from provisioner import LLDAPProvisioner, dispatch


class PlatformGroupBoundaryTests(unittest.TestCase):
    # Standard library only: the CI image (python:3.12-slim) has no pytest.
    def test_platform_groups_refused_before_directory_login(self):
        for path in ("/v1/groups/ensure", "/v1/groups/revoke"):
            for group in ("net-kingdom-admins", "net-kingdom-users", "net-kingdom-future-role"):
                with self.subTest(path=path, group=group):
                    provider = LLDAPProvisioner(
                        base_url="https://directory.invalid", admin_password="synthetic-fixture",
                    )
                    provider._login = Mock(side_effect=AssertionError("must not contact directory"))
                    payload = {
                        "groups": ["activity-core-operators", group],
                        "members": {group: ["agent-codex"]},
                        "idempotency_key": "platform-boundary-test",
                        "correlation_id": "source-test",
                        "delete_if_empty": True,
                    }
                    with self.assertRaisesRegex(ValueError, "reserved"):
                        dispatch(provider, path, payload)
                    provider._login.assert_not_called()


if __name__ == "__main__":
    unittest.main()