def test_admin_manages_employees(admin_api, staff_api):
    r = admin_api.post("/api/users", json={"username": "neo", "password": "neo-secret", "first_name": "Neo",
                                            "is_admin": False})
    assert r.status_code == 200, r.text
    uid = r.json()["id"]
    upd = admin_api.put(f"/api/users/{uid}", json={"first_name": "Neo", "last_name": "A", "email": "n@x",
                                                    "mobile": "021", "is_admin": True}).json()
    assert upd["full_name"] == "Neo A" and upd["is_admin"]
    assert admin_api.post(f"/api/users/{uid}/password", json={"password": "another-pw"}).status_code == 204
    assert admin_api.post("/api/users/lock", json={"ids": [uid], "locked": True}).status_code == 204
    neo = next(u for u in admin_api.get("/api/users").json()["items"] if u["id"] == uid)
    assert not neo["is_active"]
    assert admin_api.post("/api/users/delete", json={"ids": [uid]}).status_code == 204


def test_admin_cannot_delete_self(admin_api):
    me = next(u for u in admin_api.get("/api/users").json()["items"] if u["username"] == "boss")
    r = admin_api.post("/api/users/delete", json={"ids": [me["id"]]})
    assert r.status_code == 400


def test_password_too_short_rejected(admin_api):
    r = admin_api.post("/api/users", json={"username": "x", "password": "short"})
    assert r.status_code == 400 and r.json()["field"] == "password"


def test_account_profile(staff_api):
    assert staff_api.put("/api/account", json={"first_name": "Sam", "last_name": "S", "email": "s@x",
                                               "mobile": "1"}).status_code == 200
    me = staff_api.get("/api/account").json()
    assert (me["full_name"], me["email"]) == ("Sam S", "s@x")
    assert staff_api.get("/api/users").status_code == 403