"""安全治理中心 — unified overview aggregate RBAC + shape."""
from __future__ import annotations

import pytest
from httpx import AsyncClient


@pytest.mark.asyncio
async def test_governance_overview_rbac_and_shape(
    client: AsyncClient, auditor_headers, employee_headers,
):
    ok = await client.get(
        "/api/v1/auditor/governance/overview", headers=auditor_headers,
    )
    assert ok.status_code == 200, ok.text
    data = ok.json()["data"]
    # the aggregate stitches all four pillars without crashing on an empty DB
    assert "self_check" in data
    assert "latest_assessment" in data
    assert "open_measures" in data
    assert "controls" in data
    assert data["self_check"]["category_count"] >= 0

    denied = await client.get(
        "/api/v1/auditor/governance/overview", headers=employee_headers,
    )
    assert denied.status_code == 403