def test_get_users_admin(client, admin_token):
    """测试管理员获取用户列表"""
    response = client.get(
        "/api/users",
        headers={"Authorization": f"Bearer {admin_token}"}
    )
    assert response.status_code == 200
    assert len(response.json()) >= 3


def test_get_users_non_admin(client, marketing_token):
    """测试非管理员获取用户列表（权限不足）"""
    response = client.get(
        "/api/users",
        headers={"Authorization": f"Bearer {marketing_token}"}
    )
    assert response.status_code == 403
    assert "Not enough permissions" in response.json()["detail"]


def test_create_user_admin(client, admin_token):
    """测试管理员创建用户"""
    new_user = {
        "username": "new_test_user",
        "password": "new_password",
        "department": "Test Department",
        "role": "other"
    }
    response = client.post(
        "/api/users",
        json=new_user,
        headers={"Authorization": f"Bearer {admin_token}"}
    )
    assert response.status_code == 200
    assert response.json()["username"] == "new_test_user"
    assert response.json()["department"] == "Test Department"
    assert response.json()["role"] == "other"


def test_create_user_non_admin(client, marketing_token):
    """测试非管理员创建用户（权限不足）"""
    new_user = {
        "username": "new_test_user",
        "password": "new_password",
        "department": "Test Department",
        "role": "other"
    }
    response = client.post(
        "/api/users",
        json=new_user,
        headers={"Authorization": f"Bearer {marketing_token}"}
    )
    assert response.status_code == 403
    assert "Not enough permissions" in response.json()["detail"]


def test_create_user_existing_username(client, admin_token):
    """测试创建用户 - 用户名已存在"""
    new_user = {
        "username": "test_admin",
        "password": "new_password",
        "department": "Test Department",
        "role": "other"
    }
    response = client.post(
        "/api/users",
        json=new_user,
        headers={"Authorization": f"Bearer {admin_token}"}
    )
    assert response.status_code == 400
    assert "Username already registered" in response.json()["detail"]


def test_update_user_admin(client, admin_token):
    """测试管理员更新用户"""
    # 先获取用户ID，选择一个非管理员用户
    response = client.get(
        "/api/users",
        headers={"Authorization": f"Bearer {admin_token}"}
    )
    users = response.json()
    
    # 找到一个非管理员用户
    user_id = None
    for user in users:
        if user["role"] != "admin":
            user_id = user["id"]
            break
    
    assert user_id is not None, "No non-admin user found for update"
    
    # 更新用户
    update_data = {
        "password": "updated_password",
        "department": "Updated Department",
        "role": "other"
    }
    response = client.put(
        f"/api/users/{user_id}",
        json=update_data,
        headers={"Authorization": f"Bearer {admin_token}"}
    )
    assert response.status_code == 200
    assert response.json()["department"] == "Updated Department"
    assert response.json()["role"] == "other"


def test_update_user_non_admin(client, marketing_token):
    """测试非管理员更新用户（权限不足）"""
    # 先获取用户ID
    response = client.get(
        "/api/users",
        headers={"Authorization": f"Bearer {marketing_token}"}
    )
    assert response.status_code == 403


def test_delete_user_admin(client, admin_token):
    """测试管理员删除用户"""
    # 先创建一个新的测试用户
    new_user = {
        "username": "delete_test_user",
        "password": "delete_password",
        "department": "Test Department",
        "role": "other"
    }
    create_response = client.post(
        "/api/users",
        json=new_user,
        headers={"Authorization": f"Bearer {admin_token}"}
    )
    
    # 确保创建用户成功
    assert create_response.status_code == 200
    user_id = create_response.json()["id"]
    
    # 删除用户
    response = client.delete(
        f"/api/users/{user_id}",
        headers={"Authorization": f"Bearer {admin_token}"}
    )
    
    # 确保删除用户成功
    assert response.status_code == 200
    assert "User deleted successfully" in response.json()["message"]


def test_delete_user_non_admin(client, marketing_token):
    """测试非管理员删除用户（权限不足）"""
    # 假设用户ID为1
    response = client.delete(
        "/api/users/1",
        headers={"Authorization": f"Bearer {marketing_token}"}
    )
    assert response.status_code == 403
    assert "Not enough permissions" in response.json()["detail"]