"""Permission discovery must preserve administrator choices and avoid N+1 reads."""

import pytest
from sqlalchemy import event, func, select
from sqlalchemy.ext.asyncio import AsyncSession

from app.models.user import Permission, RolePermission
from app.repositories.permission_repository import PermissionRepository


@pytest.mark.asyncio
async def test_batched_seed_preserves_disabled_permissions_and_role_choices(db_session: AsyncSession) -> None:
    repository = PermissionRepository()
    await repository.seed_permissions(db_session)
    permission = await db_session.scalar(select(Permission).where(Permission.code == "sample:write"))
    mapping = await db_session.scalar(
        select(RolePermission).where(
            RolePermission.role == "phlebotomist", RolePermission.permission_id == permission.id
        )
    )
    permission.is_active = False
    mapping.default_granted = False
    await db_session.commit()
    permission_count = await db_session.scalar(select(func.count(Permission.id)))
    mapping_count = await db_session.scalar(select(func.count(RolePermission.id)))

    selects: list[str] = []

    def record_query(conn, cursor, statement, parameters, context, executemany):
        if statement.lstrip().upper().startswith("SELECT"):
            selects.append(statement)

    engine = db_session.bind.sync_engine
    event.listen(engine, "before_cursor_execute", record_query)
    try:
        await repository.seed_permissions(db_session)
    finally:
        event.remove(engine, "before_cursor_execute", record_query)
    assert len(selects) == 1
    await db_session.refresh(permission)
    await db_session.refresh(mapping)
    assert permission.is_active is False
    assert mapping.default_granted is False
    assert await db_session.scalar(select(func.count(Permission.id))) == permission_count
    assert await db_session.scalar(select(func.count(RolePermission.id))) == mapping_count