from __future__ import annotations


def _login(client, email: str, password: str) -> dict[str, str]:
    response = client.post("/api/v1/auth/login", json={"email": email, "password": password})
    assert response.status_code == 200
    return {"Authorization": f"Bearer {response.json()['access_token']}"}


def test_superuser_can_read_install_secrets(client):
    headers = _login(client, "admin@compton.example", "Admin1234")
    response = client.get("/api/v1/admin/secrets", headers=headers)
    assert response.status_code == 200
    payload = response.json()
    assert "secrets_status" in payload
    assert payload["secrets_status"]["postgres_password"] in {"configured", "missing"}
    assert "POSTGRES_PASSWORD" not in str(payload)


def test_non_superuser_cannot_read_install_secrets(client):
    headers = _login(client, "ops@compton.example", "OpsAdmin1234")
    response = client.get("/api/v1/admin/secrets", headers=headers)
    assert response.status_code == 403


def test_superuser_can_reveal_db_password(client):
    headers = _login(client, "admin@compton.example", "Admin1234")
    response = client.post(
        "/api/v1/admin/secrets/reveal",
        headers=headers,
        json={"key": "database_password"},
    )
    assert response.status_code == 200
    assert response.json()["key"] == "database_password"
    assert "value" in response.json()