import os
import tempfile
import unittest

from werkzeug.security import generate_password_hash

from app import create_app, db
from app.models import WebUser
from config import TestingConfig

from tests.kiosk_test_env import kiosk_client_kwargs


class PublicTokenConfig(TestingConfig):
    _TMP_DIR = tempfile.mkdtemp(prefix="wesp-public-token-tests-")
    SQLALCHEMY_DATABASE_URI = f"sqlite:///{os.path.join(_TMP_DIR, 'recipes_test.db')}"
    SQLALCHEMY_BINDS = {"reports": f"sqlite:///{os.path.join(_TMP_DIR, 'reports_test.db')}"}
    AUTH_LOGIN = "public-admin"
    AUTH_PASSWORD = "public-secret"
    SIMULATION_MODE = True
    KIOSK_ENFORCE_PAIRED_ONLY = True


class PublicDeviceTokenGuardsTests(unittest.TestCase):
    def setUp(self) -> None:
        self.app = create_app(PublicTokenConfig)
        self.client = self.app.test_client()
        self.ctx = self.app.app_context()
        self.ctx.push()
        db.create_all()
        db.session.add(
            WebUser(
                login="public-admin",
                password_hash=generate_password_hash("public-secret"),
                is_superuser=True,
            )
        )
        db.session.commit()
        kw = kiosk_client_kwargs()
        login = self.client.post(
            "/api/auth/login",
            json={"login": "public-admin", "password": "public-secret"},
            **kw,
        )
        self.assertEqual(login.status_code, 200)
        self.client.get("/scales", **kw)

    def tearDown(self) -> None:
        from app.routes import scales as scales_module

        reader = getattr(scales_module, "_scales_reader", None)
        if reader is not None:
            reader.stop()
            scales_module._scales_reader = None
        db.session.remove()
        db.drop_all()
        self.ctx.pop()

    def _pair_terminal(self) -> None:
        kw = kiosk_client_kwargs()
        pair = self.client.post("/api/kiosk/pair-token", **kw)
        self.assertEqual(pair.status_code, 200)
        token = pair.get_json().get("token")
        self.assertTrue(token)
        self.client.get(f"/api/kiosk/pair/confirm?token={token}", **kw)
        confirm = self.client.post(
            "/api/kiosk/pair/confirm",
            data={"token": token},
            content_type="application/x-www-form-urlencoded",
            **kw,
        )
        self.assertEqual(confirm.status_code, 302)

    def test_paired_guard_for_scales(self) -> None:
        kw = kiosk_client_kwargs()
        unauthorized = self.client.get("/current_weight", **kw)
        self.assertEqual(unauthorized.status_code, 401)

        self._pair_terminal()
        authorized = self.client.get("/current_weight", **kw)
        self.assertEqual(authorized.status_code, 200)

    def test_paired_guard_for_selected_public_apis(self) -> None:
        kw = kiosk_client_kwargs()
        without_token = self.client.post("/api/save_report", json={}, **kw)
        self.assertEqual(without_token.status_code, 401)

        self._pair_terminal()

        save_report = self.client.post("/api/save_report", json={}, **kw)
        self.assertNotEqual(save_report.status_code, 401)

        save_unloading = self.client.post("/api/save_unloading_report", json={}, **kw)
        self.assertNotEqual(save_unloading.status_code, 401)

        weight_display = self.client.get("/api/weight_display_data", **kw)
        self.assertEqual(weight_display.status_code, 200)

        send_nav = self.client.post(
            "/api/send_navigation_command", json={"command": "next"}, **kw
        )
        self.assertEqual(send_nav.status_code, 200)

        # Legacy loading UI (recipes_selection.html) without admin session; must not be 401.
        sync_ls = self.client.post("/api/sync_loading_state", json={}, **kw)
        self.assertNotEqual(sync_ls.status_code, 401)
        update_ls = self.client.post("/api/update_loading_state", json={}, **kw)
        self.assertNotEqual(update_ls.status_code, 401)
        nav = self.client.post("/api/navigate_component", json={"direction": "next"}, **kw)
        self.assertNotEqual(nav.status_code, 401)
        reset = self.client.post("/api/reset_component", json={}, **kw)
        self.assertNotEqual(reset.status_code, 401)

        check_db_client = self.client.post(
            "/api/sync/check-db-client",
            json={"client_id": "demo-client"},
            **kw,
        )
        self.assertNotEqual(check_db_client.status_code, 401)

        recipes = self.client.get("/api/recipes", **kw)
        self.assertEqual(recipes.status_code, 200)

    def test_restore_db_stays_disabled_with_token(self) -> None:
        restore = self.client.post(
            "/api/sync/restore-db",
            json={"type": "full"},
            **kiosk_client_kwargs(),
        )
        self.assertIn(restore.status_code, (401, 501))


if __name__ == "__main__":
    unittest.main()