"""URLConf for tests: the real APIs plus a probe endpoint guarded exactly like a business module."""
from django.urls import include, path
from rest_framework.response import Response
from rest_framework.views import APIView

from apps.access.drf import TenantPermission


class ProbeView(APIView):
    permission_classes = [TenantPermission]
    module_code = "attendance"
    permission_map = {"GET": "attendance.view"}

    def get(self, request):
        return Response({"organization": request.organization.slug})


class UnmappedView(APIView):
    """Forgot to declare permission_map: must be denied, not allowed."""

    permission_classes = [TenantPermission]

    def get(self, request):
        return Response({"leaked": True})


urlpatterns = [
    path("probe/", ProbeView.as_view()),
    path("unmapped/", UnmappedView.as_view()),
    path("api/v1/", include("interfaces.api_v1.urls")),
    path("api/", include("interfaces.api.urls")),
]