import os
import tempfile
import unittest

from app import create_app, db
from app.models import WebUser
from config import TestingConfig
from werkzeug.security import check_password_hash, generate_password_hash


class AuthEnvTestConfig(TestingConfig):
    _TMP_DIR = tempfile.mkdtemp(prefix="wesp-auth-tests-")
    SQLALCHEMY_DATABASE_URI = f"sqlite:///{os.path.join(_TMP_DIR, 'recipes_test.db')}"
    SQLALCHEMY_BINDS = {"reports": f"sqlite:///{os.path.join(_TMP_DIR, 'reports_test.db')}"}
    AUTH_LOGIN = "env-admin"
    AUTH_PASSWORD = "env-secret"


class AuthEnvOnlyTests(unittest.TestCase):
    def setUp(self) -> None:
        self.app = create_app(AuthEnvTestConfig)
        self.client = self.app.test_client()
        self.ctx = self.app.app_context()
        self.ctx.push()
        db.create_all()
        db.session.add(
            WebUser(
                login="env-admin",
                password_hash=generate_password_hash("env-secret"),
                is_superuser=True,
            )
        )
        db.session.commit()

    def tearDown(self) -> None:
        db.session.remove()
        db.drop_all()
        self.ctx.pop()

    def test_login_uses_env_credentials(self) -> None:
        bad = self.client.post(
            "/api/auth/login", json={"login": "env-admin", "password": "wrong"}
        )
        self.assertEqual(bad.status_code, 401)

        ok = self.client.post(
            "/api/auth/login", json={"login": "env-admin", "password": "env-secret"}
        )
        self.assertEqual(ok.status_code, 200)
        self.assertTrue(ok.get_json().get("authenticated"))

    def test_get_current_credentials_never_returns_password(self) -> None:
        self.client.post(
            "/api/auth/login", json={"login": "env-admin", "password": "env-secret"}
        )
        resp = self.client.get("/api/auth/get_current_credentials")
        self.assertEqual(resp.status_code, 200)
        body = resp.get_json()
        self.assertEqual(body.get("login"), "env-admin")
        self.assertEqual(body.get("password"), "")
        self.assertEqual(body.get("user_rules", {}).get("password_min_len"), 8)

    def test_change_credentials_updates_web_user_with_policy(self) -> None:
        self.client.post(
            "/api/auth/login", json={"login": "env-admin", "password": "env-secret"}
        )
        resp = self.client.post(
            "/api/auth/change_credentials",
            json={
                "old_login": "env-admin",
                "old_password": "env-secret",
                "new_login": "env-admin-2",
                "new_password": "new-secret-9",
                "confirm_password": "new-secret-9",
            },
        )
        self.assertEqual(resp.status_code, 200, resp.get_data(as_text=True))

        user = db.session.query(WebUser).filter_by(login="env-admin-2").one()
        self.assertTrue(check_password_hash(user.password_hash, "new-secret-9"))

        weak = self.client.post(
            "/api/auth/change_credentials",
            json={
                "old_login": "env-admin-2",
                "old_password": "new-secret-9",
                "new_login": "env-admin-2",
                "new_password": "12345678",
                "confirm_password": "12345678",
            },
        )
        self.assertEqual(weak.status_code, 400, weak.get_data(as_text=True))


if __name__ == "__main__":
    unittest.main()