from tests.helpers import latest_token, register_and_verify


def test_auth_brute_force_lockout(client):
    register_and_verify(client, "locked@example.com")

    for _ in range(5):
        response = client.post(
            "/api/v1/auth/login",
            json={"email": "locked@example.com", "password": "WrongPass1"},
        )
        assert response.status_code == 401

    locked = client.post(
        "/api/v1/auth/login",
        json={"email": "locked@example.com", "password": "Valid123"},
    )
    assert locked.status_code == 429
    assert locked.json()["detail"] == "ACCOUNT_TEMPORARILY_LOCKED"