def test_signup_and_login(client):
    response = client.post("/auth/signup", json={"email": "a@example.com", "password": "secret123"})
    assert response.status_code == 201
    assert response.json()["email"] == "a@example.com"

    response = client.post("/auth/login", json={"email": "a@example.com", "password": "secret123"})
    assert response.status_code == 200
    body = response.json()
    assert body["token_type"] == "bearer"
    assert body["access_token"]


def test_signup_duplicate_email_rejected(client):
    client.post("/auth/signup", json={"email": "dup@example.com", "password": "secret123"})
    response = client.post("/auth/signup", json={"email": "dup@example.com", "password": "secret123"})
    assert response.status_code == 400


def test_login_wrong_password_rejected(client):
    client.post("/auth/signup", json={"email": "b@example.com", "password": "secret123"})
    response = client.post("/auth/login", json={"email": "b@example.com", "password": "wrong"})
    assert response.status_code == 401


def test_protected_route_requires_token(client):
    response = client.get("/patients")
    assert response.status_code == 401


def test_first_user_becomes_admin_and_second_does_not(client):
    first = client.post("/auth/signup", json={"email": "first@example.com", "password": "secret123"})
    assert first.status_code == 201
    assert first.json()["is_admin"] is True

    second = client.post("/auth/signup", json={"email": "second@example.com", "password": "secret123"})
    assert second.status_code == 201
    assert second.json()["is_admin"] is False