def test_manager_can_create_and_update_user(ops_client):
    created = ops_client.post(
        "/api/v1/users",
        json={
            "email": "planner@example.test",
            "display_name": "Fleet Planner",
            "role": "rental_employee",
            "password": "a-secure-demo-password",
        },
    )
    assert created.status_code == 201
    public_ref = created.json()["public_ref"]
    assert created.json()["active"] is True
    updated = ops_client.patch(
        f"/api/v1/users/{public_ref}",
        json={"display_name": "Senior Fleet Planner", "active": False},
    )
    assert updated.status_code == 200
    assert updated.json()["display_name"] == "Senior Fleet Planner"
    assert updated.json()["active"] is False
    assert any(user["public_ref"] == public_ref for user in ops_client.get("/api/v1/users").json())


def test_employee_cannot_manage_users(employee_client):
    assert employee_client.get("/api/v1/users").status_code == 403
    assert (
        employee_client.post(
            "/api/v1/users",
            json={
                "email": "unauthorised@example.test",
                "display_name": "Unauthorised User",
                "role": "rental_employee",
                "password": "a-secure-demo-password",
            },
        ).status_code
        == 403
    )
    assert (
        employee_client.patch(
            "/api/v1/users/USR-OPS",
            json={"display_name": "Unauthorised Change"},
        ).status_code
        == 403
    )