def test_admin_can_list_users(client, admin_headers):
    response = client.get('/api/v1/users', headers=admin_headers)
    assert response.status_code == 200
    data = response.get_json()
    assert isinstance(data, list)

def test_user_cannot_list_users(client, user_headers):
    response = client.get('/api/v1/users', headers=user_headers)
    assert response.status_code == 403
    data = response.get_json()
    assert 'Acesso negado' in data['error']

def test_user_cannot_create_user(client, user_headers):
    response = client.post('/api/v1/users', headers=user_headers, json={
        'nome': 'Hacker User',
        'email': 'hacker@test.com',
        'password': 'Password123!',
        'role': 'user'
    })
    assert response.status_code == 403

def test_user_cannot_delete_user(client, user_headers, admin_user):
    response = client.delete(f'/api/v1/users/{admin_user.id}', headers=user_headers)
    assert response.status_code == 403

def test_user_cannot_expunge_database(client, user_headers):
    response = client.delete('/api/v1/leads/bulk', headers=user_headers)
    assert response.status_code == 403

def test_admin_can_create_and_delete_user(client, admin_headers):
    # Criar usuario
    create_res = client.post('/api/v1/users', headers=admin_headers, json={
        'nome': 'Novo Operador',
        'email': 'operador@test.com',
        'password': 'OperadorPass123!',
        'role': 'user'
    })
    assert create_res.status_code == 201
    new_user_id = create_res.get_json()['id']

    # Deletar usuario
    delete_res = client.delete(f'/api/v1/users/{new_user_id}', headers=admin_headers)
    assert delete_res.status_code == 200