# Tests in this file use the secretariat credentials
import requests
import json
from src import env, utils
from src.utils import (assert_contains, ok_response_contains,
                       ok_response_contains_json, response_contains,
                       response_contains_json)

#### GET /users ####
def test_get_all_users():
    """ secretariat users can request a list of all users """
    res = requests.get(
        f'{env.AWG_BASE_URL}/api/users',
        headers=utils.BASE_HEADERS
    )
    assert json.loads(res.content.decode())['users'][0]['username'] == '<EMAIL>'
    assert json.loads(res.content.decode())['users'][0]['name']['first'] == 'Jeremy'
    assert '"secret"' not in res.content.decode() # check that no secrets are included
    assert res.status_code == 200

#### GET /users ####
def test_regular_users_cannot_get_all_users(reg_user_headers):
    """ regular users cannot request a list of all users """
    res = requests.get(
        f'{env.AWG_BASE_URL}/api/users',
        headers=reg_user_headers
    )
    assert res.status_code == 403
    response_contains_json(res, 'error', 'SECRETARIAT_ONLY')


#### GET /users ####
def test_org_admins_cannot_get_all_users(org_admin_headers):
    """ org admins cannot request a list of all users """
    res = requests.get(
        f'{env.AWG_BASE_URL}/api/users',
        headers=org_admin_headers
    )
    assert res.status_code == 403
    response_contains_json(res, 'error', 'SECRETARIAT_ONLY')
# Tests in this file use the secretariat credentials
import requests
import json
from src import env, utils
from src.utils import (assert_contains, ok_response_contains,
                       ok_response_contains_json, response_contains,
                       response_contains_json)

#### GET /users ####
def test_get_all_users():
    """ secretariat users can request a list of all users """
    res = requests.get(
        f'{env.AWG_BASE_URL}/api/users',
        headers=utils.BASE_HEADERS
    )
    assert json.loads(res.content.decode())['users'][0]['username'] == '<EMAIL>'
    assert json.loads(res.content.decode())['users'][0]['name']['first'] == 'Jeremy'
    assert '"secret"' not in res.content.decode() # check that no secrets are included
    assert res.status_code == 200

#### GET /users ####
def test_regular_users_cannot_get_all_users(reg_user_headers):
    """ regular users cannot request a list of all users """
    res = requests.get(
        f'{env.AWG_BASE_URL}/api/users',
        headers=reg_user_headers
    )
    assert res.status_code == 403
    response_contains_json(res, 'error', 'SECRETARIAT_ONLY')


#### GET /users ####
def test_org_admins_cannot_get_all_users(org_admin_headers):
    """ org admins cannot request a list of all users """
    res = requests.get(
        f'{env.AWG_BASE_URL}/api/users',
        headers=org_admin_headers
    )
    assert res.status_code == 403
    response_contains_json(res, 'error', 'SECRETARIAT_ONLY')
# Tests in this file use the secretariat credentials #### GET /users #### secretariat users can request a list of all users # check that no secrets are included #### GET /users #### regular users cannot request a list of all users #### GET /users #### org admins cannot request a list of all users