"""New-club signup must never grant administration of an existing tenant."""
from application_harness import Application
app=Application();checks=0
def check(ok,message):
    global checks
    assert ok,message
    checks+=1;print('PASS:',message)
def signup(name='newowner',email='newowner@example.test',club='New owner club',kind='new_club',**extra):
    app.fixture('clearTestAttempts')
    _,body,_=app.request('/main.php?Xaction=signup')
    return app.request(data={'action':'SignUp.createAccount','csrf_token':app.csrf(body),'user_first_name':'New','user_last_name':'Owner','user_email':email,'user_name':name,'user_password':'New owner password 123!','user_password_confirm':'New owner password 123!','registration_kind':kind,'club_name':club,**extra})
try:
    ids=app.fixture('tenantSeed');before=app.fixture('inspect')
    status,body,_=app.request('/main.php?Xaction=signup')
    check(status==200 and b'name="club_name"' in body and b'value="new_club"' in body,'Default signup asks for a new club')
    status,body,_=signup(club='')
    check(b'Enter your new club name' in body and app.fixture('inspect')==before,'Missing club name creates no account or club')
    status,body,_=signup(club='X'*129)
    check(b'Enter your new club name' in body and app.fixture('inspect')==before,'Server rejects overlong club names without partial records')
    status,body,_=signup(kind='account')
    check(b'Choose a valid signup option' in body and app.fixture('inspect')==before,'Public signup cannot use the internal account-only mode')
    app.fixture('mfaTestAuditFailure','on')
    status,body,_=signup()
    app.fixture('mfaTestAuditFailure','off')
    check(status==500 and app.fixture('inspect')==before,'Audit failure rolls back account, club and administrator membership')
    status,body,_=signup(club='Tenant Alpha',user_role='Super System Administrator',club_serial=ids['clubA'])
    state=app.fixture('inspect');owner=next(u for u in state['users'] if u['user_name']=='newowner');memberships=[m for m in state['club_memberships'] if m['user_serial']==owner['user_serial']];club=memberships[0]['club_serial']
    check(status==200 and b'Your account has been created' in body,'New-club signup succeeds')
    check(owner['user_role']=='User' and owner['user_email_verified_at'] is None,'Signup keeps the global role unprivileged and email unverified')
    check(len(memberships)==1 and memberships[0]['membership_role']=='administrator' and club!=ids['clubA'],'Matching an existing club name creates an independent tenant with its own administrator')
    before=state;signup()
    check(app.fixture('inspect')==before,'Duplicate account submission creates no orphan club')
    app.login('newowner@example.test','New owner password 123!')
    check(app.request('/main.php?Xaction=Roster.workspace&club_serial='+str(club))[0]==403,'Unverified club owner cannot open the club')
    app.fixture('verifyEmail','newowner');app.logout()
    # Real login helper enrolls MFA only when the application requires it.
    app.login('newowner@example.test','New owner password 123!')
    check(bool(app.fixture('mfaState','newowner@example.test')['factor']),'Verified new administrator must enroll an authenticator')
    status,body,_=app.request()
    check(status==200 and b'class="container-fluid py-3 clubSummary"' in body and b'<h1>Tenant Alpha</h1>' in body,'Verified owner lands directly in the summary-style club page')
    check(b'>Create club</button>' not in body and b'Xaction=Roster.createClub' not in body,'Club administrator sees no global club-creation controls')
    check(app.request('/main.php?Xaction=Roster.workspace&club_serial='+str(ids['clubA']))[0]==403,'New administrator cannot open the pre-existing club with the same name')
    check(app.request('/main.php?Xaction=Roster.createClub')[0]==403,'Dedicated creation page rejects club administrators')
    app.logout();before=app.fixture('inspect');status,body,_=signup('notinvited','notinvited@example.test',kind='invited')
    check(b'Ask your club administrator' in body and app.fixture('inspect')==before,'Member signup requires a current invitation to the submitted email')
    app.fixture('seedTenantInvitation',str(ids['clubA']),'1','newmember@example.test');before=app.fixture('inspect')
    status,body,_=signup('newmember','newmember@example.test',kind='invited')
    after=app.fixture('inspect');member=next(u for u in after['users'] if u['user_name']=='newmember')
    check(status==200 and b'Your account has been created' in body and len(after['clubs'])==len(before['clubs']),'Invited signup creates an account without creating another club')
    check(not any(m['user_serial']==member['user_serial'] for m in after['club_memberships']),'Invitation signup does not skip email verification or invitation acceptance')
    app.login();status,body,_=app.request('/main.php?Xaction=Roster.createClub')
    check(status==200 and b'>Create club</button>' in body,'Super Administrator retains a separate Create club page')
    print(checks,'club onboarding HTTP checks passed.')
finally:
    app.fixture('mfaTestAuditFailure','off');app.close()