import pytest

pytest.importorskip("fastapi")
from fastapi.testclient import TestClient  # noqa: E402

from app.server import app  # noqa: E402


def test_no_site_passcode_means_open(monkeypatch):
    monkeypatch.delenv("CURATORBOT_SITE_PASSCODE", raising=False)
    c = TestClient(app)
    assert c.get("/").status_code == 200
    assert c.get("/api/interviews").status_code == 200


def test_site_passcode_gates_pages_and_api(monkeypatch):
    monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "open sesame")
    c = TestClient(app, follow_redirects=False)
    r = c.get("/")
    assert r.status_code == 303 and r.headers["location"] == "/login"
    r = c.get("/api/interviews/DEMO-0001")
    assert r.status_code == 401 and r.headers["x-login-required"] == "1"
    assert c.get("/static/app.js").status_code == 303
    assert c.get("/login").status_code == 200

    r = c.post("/login", data={"passcode": "wrong"})
    assert r.status_code == 401 and "not right" in r.text and "set-cookie" not in r.headers

    r = c.post("/login", data={"passcode": "open sesame"})
    assert r.status_code == 303 and "HttpOnly" in r.headers["set-cookie"]
    assert c.get("/").status_code == 200
    assert c.get("/api/interviews").status_code == 200

    # changing the passcode signs everyone out
    monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "new one")
    assert c.get("/api/interviews").status_code == 401

    c.get("/logout")
    monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "open sesame")
    assert c.get("/api/interviews").status_code == 401


def test_site_passcode_header_for_scripts(monkeypatch):
    monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "open sesame")
    c = TestClient(app)
    assert c.get("/api/health", headers={"X-Site-Passcode": "open sesame"}).status_code == 200
    assert c.get("/api/health", headers={"X-Site-Passcode": "nope"}).status_code == 401


def test_https_cookie_works_inside_the_space_frame(monkeypatch):
    monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "open sesame")
    c = TestClient(app, follow_redirects=False)
    r = c.post("/login", data={"passcode": "open sesame"}, headers={"X-Forwarded-Proto": "https"})
    cookie = r.headers["set-cookie"]
    assert "Secure" in cookie and "SameSite=None" in cookie and "Partitioned" in cookie


def test_tab_icon_is_served_without_signing_in(monkeypatch):
    from fastapi.testclient import TestClient
    monkeypatch.setenv("CURATORBOT_SITE_PASSCODE", "secret")
    from app.server import app
    c = TestClient(app)
    for path in ("/favicon.svg", "/favicon.ico"):
        r = c.get(path)
        assert r.status_code == 200 and r.headers["content-type"].startswith("image/svg+xml") and b"<svg" in r.content
    assert 'rel="icon"' in c.get("/login").text