"""Service group operations must never reach platform IAM groups."""
from unittest.mock import Mock

import pytest

from provisioner import LLDAPProvisioner, dispatch


@pytest.mark.parametrize("path", ["/v1/groups/ensure", "/v1/groups/revoke"])
@pytest.mark.parametrize("group", [
    "net-kingdom-admins", "net-kingdom-users", "net-kingdom-future-role",
])
def test_platform_groups_refused_before_directory_login(path, group):
    provider = LLDAPProvisioner(
        base_url="https://directory.invalid", admin_password="synthetic-fixture",
    )
    provider._login = Mock(side_effect=AssertionError("must not contact directory"))
    payload = {
        "groups": ["activity-core-operators", group],
        "members": {group: ["agent-codex"]},
        "idempotency_key": "platform-boundary-test",
        "correlation_id": "source-test",
        "delete_if_empty": True,
    }
    with pytest.raises(ValueError, match="reserved"):
        dispatch(provider, path, payload)
    provider._login.assert_not_called()