

def test_delete_user_with_tokens_and_audit_history(client, auth_headers, app, db):
    """Deleting a user revokes their API tokens and detaches (not deletes)
    their audit rows - the importer-user case."""
    from werkzeug.security import generate_password_hash
    from shopdb.core.models import User, ApiToken, AuditLog

    with app.app_context():
        user = User(username='importer2', email='importer2@test.local',
                    passwordhash=generate_password_hash('x'), isactive=True)
        db.session.add(user)
        db.session.flush()
        db.session.add(ApiToken(userid=user.userid, name='import token',
                                tokenprefix='deadbeef', tokenhash='x' * 64))
        db.session.add(AuditLog(userid=user.userid, action='created',
                                entitytype='Asset', entityid=1,
                                entityname='imported thing'))
        db.session.commit()
        userid = user.userid

    response = client.delete(f'/api/users/{userid}', headers=auth_headers)
    assert response.status_code == 200, response.get_json()

    with app.app_context():
        assert db.session.get(User, userid) is None
        assert ApiToken.query.filter_by(userid=userid).count() == 0
        detached = AuditLog.query.filter_by(entityname='imported thing').one()
        assert detached.userid is None


def test_role_color_create_list_update(client, auth_headers):
    """A role carries an optional badge color through create, list, and update."""
    created = client.post('/api/users/roles', headers=auth_headers, json={
        'rolename': 'painters', 'description': 'colorful', 'color': '#ff8800',
        'permissions': [],
    })
    assert created.status_code == 201, created.get_json()
    roleid = created.get_json()['data']['roleid']
    assert created.get_json()['data']['color'] == '#ff8800'

    listed = client.get('/api/users/roles', headers=auth_headers)
    row = next(r for r in listed.get_json()['data'] if r['roleid'] == roleid)
    assert row['color'] == '#ff8800'

    updated = client.put(f'/api/users/roles/{roleid}', headers=auth_headers,
                         json={'color': '#00aa55'})
    assert updated.status_code == 200, updated.get_json()
    assert updated.get_json()['data']['color'] == '#00aa55'
