tests/test_media_auth_cookie.py

"""Regression tests for signup media-cookie setup.

CI failed because `_set_media_auth_cookie` read `settings.is_production`
while `Settings` only exposed `environment`.
"""

from __future__ import annotations

from types import SimpleNamespace

from fastapi import Response


def _media_cookie_flags(header: str) -> dict[str, object]:
    """Parse Set-Cookie attributes so JWT contents cannot fake flags."""
    parts = [part.strip() for part in header.split(";") if part.strip()]
    assert parts, f"empty Set-Cookie header: {header!r}"
    name, _, value = parts[0].partition("=")
    flags: dict[str, str | bool] = {}
    for part in parts[1:]:
        key, separator, raw = part.partition("=")
        flags[key.casefold()] = raw if separator else True
    return {
        "name": name,
        "value": value,
        "httponly": "httponly" in flags,
        "secure": "secure" in flags,
        "path": str(flags.get("path", "")),
        "samesite": str(flags.get("samesite", "")).casefold(),
    }


def test_settings_exposes_is_production_from_environment() -> None:
    from app.core.config import Settings

    assert Settings(environment="production").is_production is True
    assert Settings(environment="PRODUCTION").is_production is True
    assert Settings(environment="development").is_production is False
    assert Settings(environment=" staging ").is_production is False


def test_signup_sets_dev_media_cookie_flags(auth_client) -> None:
    response = auth_client.post(
        "/auth/signup",
        json={
            "name": "Cookie Student",
            "email": "media-cookie-fix@example.test",
            "password": "Pass123!beta",
        },
    )
    assert response.status_code == 201, response.text
    assert response.json()["access_token"]
    cookie = _media_cookie_flags(response.headers.get("set-cookie", ""))
    assert cookie["name"] == "docdoe_media_token"
    assert cookie["httponly"] is True
    assert cookie["secure"] is False
    assert cookie["path"] == "/generated"
    assert cookie["samesite"] == "lax"


def test_media_cookie_uses_settings_is_production() -> None:
    from app.core.config import Settings
    from app.routes.auth import _set_media_auth_cookie

    response = Response()
    _set_media_auth_cookie(
        response,
        "token-value",
        3600,
        settings=Settings(environment="production"),
    )
    cookie = _media_cookie_flags(response.headers.get("set-cookie", ""))
    assert cookie["name"] == "docdoe_media_token"
    assert cookie["value"] == "token-value"
    assert cookie["httponly"] is True
    assert cookie["secure"] is True
    assert cookie["path"] == "/generated"
    assert cookie["samesite"] == "none"


def test_media_cookie_falls_back_to_environment_when_flag_missing() -> None:
    from app.routes.auth import _set_media_auth_cookie

    response = Response()
    _set_media_auth_cookie(
        response,
        "token-value",
        3600,
        settings=SimpleNamespace(environment="production"),
    )
    cookie = _media_cookie_flags(response.headers.get("set-cookie", ""))
    assert cookie["httponly"] is True
    assert cookie["secure"] is True
    assert cookie["path"] == "/generated"
    assert cookie["samesite"] == "none"


def test_unknown_environment_fails_closed_to_secure_cookie() -> None:
    from app.routes.auth import _set_media_auth_cookie

    response = Response()
    _set_media_auth_cookie(
        response,
        "token-value",
        3600,
        settings=SimpleNamespace(),
    )
    cookie = _media_cookie_flags(response.headers.get("set-cookie", ""))
    assert cookie["secure"] is True
    assert cookie["samesite"] == "none"
    assert cookie["httponly"] is True
    assert cookie["path"] == "/generated"