"""Export-link authorization regression tests."""
from __future__ import annotations


def _headers(token: str) -> dict[str, str]:
    return {"Authorization": f"Bearer {token}"}


def test_export_link_is_invalid_after_current_role_demotion(client, user_store, login):
    user_store.complete_setup(
        "admin",
        "admin@example.com",
        "admin-ready-password",
        accepted_terms=True,
        accepted_terms_at="2026-08-13T00:00:00Z",
    )
    token = login("admin", "admin-ready-password")["token"]
    link_response = client.get("/api/analytics/export/token", headers=_headers(token))
    assert link_response.status_code == 200, link_response.get_json()
    export_token = link_response.get_json()["token"]

    user_store.set_role("admin", "admin")
    response = client.get(
        f"/api/analytics/export?token={export_token}",
        headers=_headers(token),
    )

    assert response.status_code == 403
    assert response.get_json() == {"error": "export link authorization is stale"}