"""DMS coverage tests — exercise uncovered paths to reach ≥80% coverage.

Targets missing lines in routes.py: tree building, path construction,
deep cascade delete, file too large, preview missing on disk,
multi-user/group sharing, share removal, search edge cases,
shared-with-me with data, bulk mixed IDs, tenant isolation.
"""

from __future__ import annotations

import os
import uuid
from unittest.mock import patch

import pytest

from tests.conftest import ORIGIN_HEADER, login_client

PDF_CONTENT = b"%PDF-1.4\n1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\n%%EOF"


# ─── Folder coverage ───


class TestFolderCoverage:
    """Coverage tests for folder endpoints — tree, path, cascade, isolation."""

    @pytest.mark.asyncio
    async def test_list_folders_deeply_nested_tree(self, authed_client):
        """GET /folders → deeply nested tree with correct paths."""
        client, _ = authed_client
        resp = await client.post("/api/v1/dms/folders", json={"name": "A"}, headers=ORIGIN_HEADER)
        a_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders",
            json={"name": "B", "parent_id": a_id},
            headers=ORIGIN_HEADER,
        )
        b_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders",
            json={"name": "C", "parent_id": b_id},
            headers=ORIGIN_HEADER,
        )

        resp = await client.get("/api/v1/dms/folders", headers=ORIGIN_HEADER)
        assert resp.status_code == 200
        tree = resp.json()
        assert len(tree) == 1
        assert tree[0]["name"] == "A"
        assert tree[0]["path"] == "A"
        assert len(tree[0]["children"]) == 1
        child = tree[0]["children"][0]
        assert child["name"] == "B"
        assert child["path"] == "A/B"
        assert len(child["children"]) == 1
        assert child["children"][0]["name"] == "C"
        assert child["children"][0]["path"] == "A/B/C"

    @pytest.mark.asyncio
    async def test_list_folders_invalid_parent_id(self, authed_client):
        """GET /folders?parent_id=invalid → 400."""
        client, _ = authed_client
        resp = await client.get("/api/v1/dms/folders?parent_id=not-a-uuid", headers=ORIGIN_HEADER)
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_create_folder_deep_nested_path(self, authed_client):
        """POST /folders → 201 with 3-level nested path."""
        client, _ = authed_client
        resp = await client.post("/api/v1/dms/folders", json={"name": "L1"}, headers=ORIGIN_HEADER)
        l1_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders",
            json={"name": "L2", "parent_id": l1_id},
            headers=ORIGIN_HEADER,
        )
        l2_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders",
            json={"name": "L3", "parent_id": l2_id},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 201
        assert resp.json()["path"] == "L1/L2/L3"

    @pytest.mark.asyncio
    async def test_update_folder_rename_and_move(self, authed_client):
        """PATCH /folders/{id} → 200, rename + move in one request."""
        client, _ = authed_client
        resp = await client.post("/api/v1/dms/folders", json={"name": "A"}, headers=ORIGIN_HEADER)
        a_id = resp.json()["id"]
        resp = await client.post("/api/v1/dms/folders", json={"name": "B"}, headers=ORIGIN_HEADER)
        b_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders",
            json={"name": "C", "parent_id": b_id},
            headers=ORIGIN_HEADER,
        )
        c_id = resp.json()["id"]

        resp = await client.patch(
            f"/api/v1/dms/folders/{c_id}",
            json={"name": "D", "parent_id": a_id},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["name"] == "D"
        assert resp.json()["parent_id"] == a_id
        assert resp.json()["path"] == "A/D"

    @pytest.mark.asyncio
    async def test_update_folder_move_to_root(self, authed_client):
        """PATCH /folders/{id} → 200, move to root via parent_id=null."""
        client, _ = authed_client
        resp = await client.post("/api/v1/dms/folders", json={"name": "P"}, headers=ORIGIN_HEADER)
        p_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders",
            json={"name": "C", "parent_id": p_id},
            headers=ORIGIN_HEADER,
        )
        c_id = resp.json()["id"]

        resp = await client.patch(
            f"/api/v1/dms/folders/{c_id}",
            json={"parent_id": None},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["parent_id"] is None
        assert resp.json()["path"] == "C"

    @pytest.mark.asyncio
    async def test_update_folder_no_changes(self, authed_client):
        """PATCH /folders/{id} → 200 with empty body (no changes)."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/folders", json={"name": "NoChange"}, headers=ORIGIN_HEADER
        )
        folder_id = resp.json()["id"]

        resp = await client.patch(
            f"/api/v1/dms/folders/{folder_id}",
            json={},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["name"] == "NoChange"

    @pytest.mark.asyncio
    async def test_update_folder_invalid_id(self, authed_client):
        """PATCH /folders/{id} → 400 invalid id."""
        client, _ = authed_client
        resp = await client.patch(
            "/api/v1/dms/folders/not-a-uuid",
            json={"name": "New"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_delete_folder_deep_cascade(self, authed_client):
        """DELETE /folders/{id} → 204, 3-level cascade with files in each."""
        client, _ = authed_client
        resp = await client.post("/api/v1/dms/folders", json={"name": "A"}, headers=ORIGIN_HEADER)
        a_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders",
            json={"name": "B", "parent_id": a_id},
            headers=ORIGIN_HEADER,
        )
        b_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders",
            json={"name": "C", "parent_id": b_id},
            headers=ORIGIN_HEADER,
        )
        c_id = resp.json()["id"]

        file_ids = []
        for folder_id in [a_id, b_id, c_id]:
            resp = await client.post(
                "/api/v1/dms/files/upload",
                files={"file": (f"f_{folder_id[:4]}.pdf", PDF_CONTENT, "application/pdf")},
                data={"folder_id": folder_id},
                headers=ORIGIN_HEADER,
            )
            assert resp.status_code == 201
            file_ids.append(resp.json()["id"])

        resp = await client.delete(f"/api/v1/dms/folders/{a_id}", headers=ORIGIN_HEADER)
        assert resp.status_code == 204

        resp = await client.get("/api/v1/dms/folders", headers=ORIGIN_HEADER)
        assert resp.json() == []

        for fid in file_ids:
            resp = await client.get(f"/api/v1/dms/files/{fid}", headers=ORIGIN_HEADER)
            assert resp.status_code == 404

    @pytest.mark.asyncio
    async def test_folder_tenant_isolation(self, authed_client, dms_client, db_session):
        """Folders visible only within their tenant."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/folders", json={"name": "TenantA"}, headers=ORIGIN_HEADER
        )
        folder_id = resp.json()["id"]

        await login_client(dms_client, "admin@tenantb.com")
        resp = await dms_client.get("/api/v1/dms/folders", headers=ORIGIN_HEADER)
        assert resp.status_code == 200
        assert resp.json() == []

        resp = await dms_client.get(
            f"/api/v1/dms/folders?parent_id={folder_id}", headers=ORIGIN_HEADER
        )
        assert resp.status_code == 404


# ─── File coverage ───


class TestFileCoverage:
    """Coverage tests for file endpoints — upload edge cases, invalid IDs, preview."""

    @pytest.mark.asyncio
    async def test_upload_file_too_large(self, authed_client):
        """POST /files/upload → 413 file too large."""
        client, _ = authed_client
        with patch("app.plugins.builtins.dms.routes.MAX_FILE_SIZE", 10):
            resp = await client.post(
                "/api/v1/dms/files/upload",
                files={"file": ("large.bin", b"\x00" * 100, "application/octet-stream")},
                headers=ORIGIN_HEADER,
            )
        assert resp.status_code == 413
        assert resp.json()["detail"]["code"] == "file_too_large"

    @pytest.mark.asyncio
    async def test_upload_empty_file(self, authed_client):
        """POST /files/upload → 201 for empty file."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("empty.txt", b"", "text/plain")},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 201
        assert resp.json()["size_bytes"] == 0

    @pytest.mark.asyncio
    async def test_upload_file_invalid_folder_id(self, authed_client):
        """POST /files/upload → 400 invalid folder_id."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("test.pdf", PDF_CONTENT, "application/pdf")},
            data={"folder_id": "not-a-uuid"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_delete_file_invalid_id(self, authed_client):
        """DELETE /files/{id} → 400 invalid id."""
        client, _ = authed_client
        resp = await client.delete("/api/v1/dms/files/bad-id", headers=ORIGIN_HEADER)
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_restore_file_invalid_id(self, authed_client):
        """POST /files/{id}/restore → 400 invalid id."""
        client, _ = authed_client
        resp = await client.post("/api/v1/dms/files/bad-id/restore", headers=ORIGIN_HEADER)
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_update_file_rename_and_move(self, authed_client):
        """PATCH /files/{id} → 200, rename + move in one request."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("original.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/folders", json={"name": "Target"}, headers=ORIGIN_HEADER
        )
        folder_id = resp.json()["id"]

        resp = await client.patch(
            f"/api/v1/dms/files/{file_id}",
            json={"name": "renamed.pdf", "folder_id": folder_id},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["name"] == "renamed.pdf"
        assert resp.json()["folder_id"] == folder_id

    @pytest.mark.asyncio
    async def test_update_file_move_to_root(self, authed_client):
        """PATCH /files/{id} → 200, move file to root via folder_id=null."""
        client, _ = authed_client
        resp = await client.post("/api/v1/dms/folders", json={"name": "F"}, headers=ORIGIN_HEADER)
        folder_id = resp.json()["id"]
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("test.pdf", PDF_CONTENT, "application/pdf")},
            data={"folder_id": folder_id},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        resp = await client.patch(
            f"/api/v1/dms/files/{file_id}",
            json={"folder_id": None},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["folder_id"] is None

    @pytest.mark.asyncio
    async def test_update_file_no_changes(self, authed_client):
        """PATCH /files/{id} → 200 with empty body (no changes)."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("test.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        resp = await client.patch(
            f"/api/v1/dms/files/{file_id}",
            json={},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["name"] == "test.pdf"

    @pytest.mark.asyncio
    async def test_update_file_invalid_id(self, authed_client):
        """PATCH /files/{id} → 400 invalid id."""
        client, _ = authed_client
        resp = await client.patch(
            "/api/v1/dms/files/bad-id",
            json={"name": "new.pdf"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_preview_file_invalid_id(self, authed_client):
        """GET /files/{id}/preview → 400 invalid id."""
        client, _ = authed_client
        resp = await client.get("/api/v1/dms/files/bad-id/preview", headers=ORIGIN_HEADER)
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_preview_file_missing_on_disk(self, authed_client):
        """GET /files/{id}/preview → 404 when file missing on disk."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("ondisk.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]
        storage_path = resp.json()["storage_path"]

        if os.path.exists(storage_path):
            os.remove(storage_path)

        resp = await client.get(f"/api/v1/dms/files/{file_id}/preview", headers=ORIGIN_HEADER)
        assert resp.status_code == 404
        assert resp.json()["detail"]["code"] == "file_missing"

    @pytest.mark.asyncio
    async def test_edit_session_invalid_id(self, authed_client):
        """POST /files/{id}/edit-session → 400 invalid id."""
        client, _ = authed_client
        resp = await client.post("/api/v1/dms/files/bad-id/edit-session", headers=ORIGIN_HEADER)
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_file_tenant_isolation(self, authed_client, dms_client, db_session):
        """Files visible only within their tenant."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("tenant_a.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        await login_client(dms_client, "admin@tenantb.com")
        resp = await dms_client.get(f"/api/v1/dms/files/{file_id}", headers=ORIGIN_HEADER)
        assert resp.status_code == 404


# ─── Share coverage ───


class TestShareCoverage:
    """Coverage tests for share endpoints — multi-user, groups, removal."""

    @pytest.mark.asyncio
    async def test_share_with_multiple_users(self, authed_client):
        """POST /files/{id}/share → 200 with multiple users."""
        client, seed = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("multi.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        viewer_id = str(seed["viewer_a"].id)
        editor_id = str(seed["editor_a"].id)

        resp = await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_ids": [viewer_id, editor_id], "access_level": "write"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["count"] == 2

    @pytest.mark.asyncio
    async def test_share_with_users_and_groups(self, authed_client):
        """POST /files/{id}/share → 200 with both users and groups."""
        client, seed = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("both.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        viewer_id = str(seed["viewer_a"].id)
        group_id = str(uuid.uuid4())

        resp = await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_ids": [viewer_id], "group_ids": [group_id], "access_level": "read"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["count"] == 2

    @pytest.mark.asyncio
    async def test_share_with_invalid_group_id(self, authed_client):
        """POST /files/{id}/share → 400 invalid group_id."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("badgroup.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        resp = await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"group_ids": ["not-a-uuid"], "access_level": "read"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_share_duplicate_group_ignored(self, authed_client):
        """POST /files/{id}/share → 200, duplicate group share ignored."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("dupgroup.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]
        group_id = str(uuid.uuid4())

        await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"group_ids": [group_id], "access_level": "read"},
            headers=ORIGIN_HEADER,
        )
        resp = await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"group_ids": [group_id], "access_level": "read"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["count"] == 0

    @pytest.mark.asyncio
    async def test_remove_share_user(self, authed_client):
        """DELETE /files/{id}/share → 204, user share removed."""
        client, seed = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("unshare_user.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]
        viewer_id = str(seed["viewer_a"].id)

        await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_ids": [viewer_id], "access_level": "read"},
            headers=ORIGIN_HEADER,
        )

        resp = await client.request(
            "DELETE",
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_id": viewer_id},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 204

    @pytest.mark.asyncio
    async def test_remove_share_no_match(self, authed_client):
        """DELETE /files/{id}/share → 204, no matching share (idempotent)."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("nomatch.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        resp = await client.request(
            "DELETE",
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_id": str(uuid.uuid4())},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 204

    @pytest.mark.asyncio
    async def test_remove_share_invalid_group_id(self, authed_client):
        """DELETE /files/{id}/share → 400 invalid group_id."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("badgid.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        resp = await client.request(
            "DELETE",
            f"/api/v1/dms/files/{file_id}/share",
            json={"group_id": "not-a-uuid"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_remove_share_both_user_and_group(self, authed_client):
        """DELETE /files/{id}/share → 204, removes both user and group shares."""
        client, seed = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("bothremoval.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]
        viewer_id = str(seed["viewer_a"].id)
        group_id = str(uuid.uuid4())

        await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_ids": [viewer_id], "group_ids": [group_id], "access_level": "read"},
            headers=ORIGIN_HEADER,
        )

        resp = await client.request(
            "DELETE",
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_id": viewer_id, "group_id": group_id},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 204


# ─── Search coverage ───


class TestSearchCoverage:
    """Coverage tests for search — special chars, partial match, tenant isolation."""

    @pytest.mark.asyncio
    async def test_search_special_characters(self, authed_client):
        """GET /search?q=50% → 200, handles special characters in filename."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("test_50%.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 201

        resp = await client.get("/api/v1/dms/search?q=50%", headers=ORIGIN_HEADER)
        assert resp.status_code == 200
        assert len(resp.json()) == 1
        assert resp.json()[0]["name"] == "test_50%.pdf"

    @pytest.mark.asyncio
    async def test_search_partial_match(self, authed_client):
        """GET /search → partial name match."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("monthly_report.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        resp = await client.get("/api/v1/dms/search?q=monthly", headers=ORIGIN_HEADER)
        assert resp.status_code == 200
        assert len(resp.json()) == 1

    @pytest.mark.asyncio
    async def test_search_tenant_isolation(self, authed_client, dms_client, db_session):
        """GET /search → only returns files from current tenant."""
        client, _ = authed_client
        await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("tenant_a_file.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )

        await login_client(dms_client, "admin@tenantb.com")
        resp = await dms_client.get("/api/v1/dms/search?q=tenant_a", headers=ORIGIN_HEADER)
        assert resp.status_code == 200
        assert resp.json() == []


# ─── Shared-with-me coverage ───


class TestSharedWithMeCoverage:
    """Coverage tests for shared-with-me — multiple files, deleted exclusion."""

    @pytest.mark.asyncio
    async def test_shared_with_me_multiple_files(self, authed_client, dms_client, db_session):
        """GET /shared-with-me → 200 with multiple shared files."""
        client, seed = authed_client
        viewer_id = str(seed["viewer_a"].id)

        file_ids = []
        for i in range(3):
            resp = await client.post(
                "/api/v1/dms/files/upload",
                files={"file": (f"shared_{i}.pdf", PDF_CONTENT, "application/pdf")},
                headers=ORIGIN_HEADER,
            )
            fid = resp.json()["id"]
            file_ids.append(fid)
            await client.post(
                f"/api/v1/dms/files/{fid}/share",
                json={"user_ids": [viewer_id], "access_level": "read"},
                headers=ORIGIN_HEADER,
            )

        await login_client(dms_client, "viewer@tenanta.com")
        resp = await dms_client.get("/api/v1/dms/shared-with-me", headers=ORIGIN_HEADER)
        assert resp.status_code == 200
        shared = resp.json()
        assert len(shared) == 3
        returned_ids = {s["id"] for s in shared}
        assert returned_ids == set(file_ids)
        for s in shared:
            assert s["access_level"] == "read"

    @pytest.mark.asyncio
    async def test_shared_with_me_excludes_deleted(self, authed_client, dms_client, db_session):
        """GET /shared-with-me → excludes soft-deleted files."""
        client, seed = authed_client
        viewer_id = str(seed["viewer_a"].id)

        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("del_share.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]
        await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_ids": [viewer_id], "access_level": "read"},
            headers=ORIGIN_HEADER,
        )
        await client.delete(f"/api/v1/dms/files/{file_id}", headers=ORIGIN_HEADER)

        await login_client(dms_client, "viewer@tenanta.com")
        resp = await dms_client.get("/api/v1/dms/shared-with-me", headers=ORIGIN_HEADER)
        assert resp.status_code == 200
        assert resp.json() == []

    @pytest.mark.asyncio
    async def test_shared_with_me_write_access(self, authed_client, dms_client, db_session):
        """GET /shared-with-me → shows write access_level correctly."""
        client, seed = authed_client
        viewer_id = str(seed["viewer_a"].id)

        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("write_share.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]
        await client.post(
            f"/api/v1/dms/files/{file_id}/share",
            json={"user_ids": [viewer_id], "access_level": "write"},
            headers=ORIGIN_HEADER,
        )

        await login_client(dms_client, "viewer@tenanta.com")
        resp = await dms_client.get("/api/v1/dms/shared-with-me", headers=ORIGIN_HEADER)
        assert resp.status_code == 200
        shared = resp.json()
        assert len(shared) == 1
        assert shared[0]["access_level"] == "write"


# ─── Bulk operations coverage ───


class TestBulkCoverage:
    """Coverage tests for bulk operations — mixed IDs, tenant isolation."""

    @pytest.mark.asyncio
    async def test_bulk_move_mixed_valid_invalid(self, authed_client):
        """POST /files/bulk-move → 200 with mixed valid/invalid file IDs."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/folders", json={"name": "Target"}, headers=ORIGIN_HEADER
        )
        folder_id = resp.json()["id"]

        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("valid.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        valid_file_id = resp.json()["id"]

        resp = await client.post(
            "/api/v1/dms/files/bulk-move",
            json={"file_ids": [valid_file_id, str(uuid.uuid4())], "target_folder_id": folder_id},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["moved"] == 1

    @pytest.mark.asyncio
    async def test_bulk_delete_mixed_valid_invalid(self, authed_client):
        """POST /files/bulk-delete → 200 with mixed valid/invalid file IDs."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("valid.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        valid_file_id = resp.json()["id"]

        resp = await client.post(
            "/api/v1/dms/files/bulk-delete",
            json={"file_ids": [valid_file_id, str(uuid.uuid4())]},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["deleted"] == 1

    @pytest.mark.asyncio
    async def test_bulk_move_invalid_target_id(self, authed_client):
        """POST /files/bulk-move → 400 invalid target_folder_id."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("f.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        file_id = resp.json()["id"]

        resp = await client.post(
            "/api/v1/dms/files/bulk-move",
            json={"file_ids": [file_id], "target_folder_id": "not-a-uuid"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 400

    @pytest.mark.asyncio
    async def test_bulk_delete_tenant_isolation(self, authed_client, dms_client, db_session):
        """POST /files/bulk-delete → 0 deleted for cross-tenant file IDs."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("tenant_a.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        tenant_a_file_id = resp.json()["id"]

        await login_client(dms_client, "admin@tenantb.com")
        resp = await dms_client.post(
            "/api/v1/dms/files/bulk-delete",
            json={"file_ids": [tenant_a_file_id]},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["deleted"] == 0

    @pytest.mark.asyncio
    async def test_bulk_move_tenant_isolation(self, authed_client, dms_client, db_session):
        """POST /files/bulk-move → 0 moved for cross-tenant file IDs."""
        client, _ = authed_client
        resp = await client.post(
            "/api/v1/dms/files/upload",
            files={"file": ("cross_tenant.pdf", PDF_CONTENT, "application/pdf")},
            headers=ORIGIN_HEADER,
        )
        tenant_a_file_id = resp.json()["id"]

        await login_client(dms_client, "admin@tenantb.com")
        resp = await dms_client.post(
            "/api/v1/dms/files/bulk-move",
            json={"file_ids": [tenant_a_file_id]},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 200
        assert resp.json()["moved"] == 0