from __future__ import annotations

import pytest

from app.main import _assert_production_guards
from app.core.config import settings


@pytest.fixture(autouse=True)
def reset_app_env(monkeypatch):
    monkeypatch.setattr(settings, "app_env", "development")
    monkeypatch.setattr(settings, "enable_test_routes", True)
    monkeypatch.setattr(settings, "enable_docs", True)
    monkeypatch.setattr(settings, "enable_rate_limit", False)
    monkeypatch.setattr(settings, "cookie_secure", False)
    monkeypatch.setattr(settings, "jwt_access_secret", "dev-access-secret-32bytes-minimum!!")
    monkeypatch.setattr(settings, "jwt_refresh_pepper", "dev-refresh-pepper-32bytes-minimum!!")
    monkeypatch.setattr(
        settings,
        "database_url",
        "postgresql+psycopg://compton_app:secret@postgres:5432/compton?sslmode=require",
    )


def test_production_guards_skip_in_development():
    _assert_production_guards()


def test_production_guards_reject_test_routes(monkeypatch):
    monkeypatch.setattr(settings, "app_env", "production")
    with pytest.raises(RuntimeError, match="ENABLE_TEST_ROUTES"):
        _assert_production_guards()


def test_production_guards_reject_insecure_cookie(monkeypatch):
    monkeypatch.setattr(settings, "app_env", "production")
    monkeypatch.setattr(settings, "enable_test_routes", False)
    monkeypatch.setattr(settings, "enable_docs", False)
    monkeypatch.setattr(settings, "enable_rate_limit", True)
    with pytest.raises(RuntimeError, match="COOKIE_SECURE"):
        _assert_production_guards()


def test_production_guards_reject_default_db_credentials(monkeypatch):
    monkeypatch.setattr(settings, "app_env", "production")
    monkeypatch.setattr(settings, "enable_test_routes", False)
    monkeypatch.setattr(settings, "enable_docs", False)
    monkeypatch.setattr(settings, "enable_rate_limit", True)
    monkeypatch.setattr(settings, "cookie_secure", True)
    monkeypatch.setattr(settings, "database_url", "postgresql://user:pass@db/app?sslmode=require")
    with pytest.raises(RuntimeError, match="Default database credentials"):
        _assert_production_guards()


def test_production_guards_reject_placeholder_jwt(monkeypatch):
    monkeypatch.setattr(settings, "app_env", "production")
    monkeypatch.setattr(settings, "enable_test_routes", False)
    monkeypatch.setattr(settings, "enable_docs", False)
    monkeypatch.setattr(settings, "enable_rate_limit", True)
    monkeypatch.setattr(settings, "cookie_secure", True)
    monkeypatch.setattr(settings, "jwt_access_secret", "change-me-access")
    with pytest.raises(RuntimeError, match="JWT_ACCESS_SECRET"):
        _assert_production_guards()


def test_production_guards_reject_placeholder_refresh_pepper(monkeypatch):
    monkeypatch.setattr(settings, "app_env", "production")
    monkeypatch.setattr(settings, "enable_test_routes", False)
    monkeypatch.setattr(settings, "enable_docs", False)
    monkeypatch.setattr(settings, "enable_rate_limit", True)
    monkeypatch.setattr(settings, "cookie_secure", True)
    monkeypatch.setattr(settings, "jwt_access_secret", "prod-access-secret-32bytes-minimum!!")
    monkeypatch.setattr(settings, "jwt_refresh_pepper", "change-me-pepper")
    with pytest.raises(RuntimeError, match="JWT_REFRESH_PEPPER"):
        _assert_production_guards()


def test_production_guards_reject_missing_sslmode(monkeypatch):
    monkeypatch.setattr(settings, "app_env", "production")
    monkeypatch.setattr(settings, "enable_test_routes", False)
    monkeypatch.setattr(settings, "enable_docs", False)
    monkeypatch.setattr(settings, "enable_rate_limit", True)
    monkeypatch.setattr(settings, "cookie_secure", True)
    monkeypatch.setattr(settings, "database_url", "postgresql://app:secret@db/app")
    with pytest.raises(RuntimeError, match="sslmode=require"):
        _assert_production_guards()
