"""Pin down the Authing → deprecated rename + ensure historical
grants still load.

Authing was removed from ``SSO_PROVIDERS`` on 2026-05-07 — the
company is consolidating on Google + Lark. Two invariants matter:

1. The application-level whitelist no longer contains "Authing", so
   the validator rejects new ``submit()`` calls for that provider.
2. The DB column is still free-text VARCHAR, so historical
   ``sso_grants`` rows with ``sso_provider='Authing'`` continue to
   load via SQLAlchemy without error — required for audit /
   leaver-handover lookups on long-lived employees.
"""
from __future__ import annotations

from app.domains.sso.service import SSO_PROVIDER_GOOGLE, SSO_PROVIDERS


def test_authing_removed_from_provider_whitelist():
    assert "Authing" not in SSO_PROVIDERS, (
        "Authing was deprecated 2026-05-07. New SSO grant requests "
        "for Authing must be rejected by the application validator. "
        "If you genuinely need to re-enable Authing, restore the "
        "tuple AND update the Feishu approval template's SSO platform "
        "single-choice options."
    )


def test_provider_whitelist_contains_only_google_and_lark():
    assert SSO_PROVIDERS == ("Google", "Lark"), (
        "Sanity check: SSO_PROVIDERS drift would silently let the "
        "Helix UI offer providers the Feishu template doesn't carry, "
        "leading to approval-flow rejection for the requester."
    )


def test_google_constant_is_exported():
    """The ``SSO_PROVIDER_GOOGLE`` constant guards against the "is
    this string Google?" check drifting between the validator,
    the executor, and the Feishu form-builder. Pin its value."""
    assert SSO_PROVIDER_GOOGLE == "Google"
    assert SSO_PROVIDER_GOOGLE in SSO_PROVIDERS