from __future__ import annotations

from unittest.mock import patch

import pytest

from app.core.security import hash_password
from app.modules.auth import repository as auth_repository
from app.modules.auth.service import issue_refresh_token, refresh
from app.modules.users.repository import create_user, get_user_by_id, update_user


def test_refresh_returns_account_blocked_for_blocked_user():
    user = create_user("blocked-svc@example.com", hash_password("Valid123"), status="active")
    token = issue_refresh_token(user.id)
    user.status = "blocked"
    update_user(user)
    auth_repository.revoke_user_families(user.id)

    with pytest.raises(PermissionError, match="ACCOUNT_BLOCKED"):
        refresh(token)


def test_refresh_returns_email_not_verified_for_pending_user():
    user = create_user("pending-svc@example.com", hash_password("Valid123"), status="pending")
    token = issue_refresh_token(user.id)

    with pytest.raises(PermissionError, match="EMAIL_NOT_VERIFIED"):
        refresh(token)


def test_refresh_rejects_revoked_token_for_active_user():
    user = create_user("active-svc@example.com", hash_password("Valid123"), status="active")
    token = issue_refresh_token(user.id)
    auth_repository.revoke_user_families(user.id)

    with patch.object(auth_repository, "revoke_family_tokens") as revoke_family:
        with pytest.raises(PermissionError, match="INVALID_REFRESH"):
            refresh(token)
        revoke_family.assert_called_once()