import pytest

from auth import is_allowed, safe_next
from conftest import login_static


# ---------- pure helpers ----------

def test_is_allowed_exact_and_casefold():
    users = [{"email": "Alice@Example.com", "role": "admin"}]
    assert is_allowed("alice@example.com", users) == (True, "admin")
    assert is_allowed("ALICE@EXAMPLE.COM", users) == (True, "admin")


def test_is_allowed_unknown():
    assert is_allowed("nobody@x.com", [{"email": "a@b.c", "role": "user"}]) == (False, None)
    assert is_allowed("", []) == (False, None)


@pytest.mark.parametrize("target,expected", [
    ("//evil.com", "/"),
    ("https://evil.com", "/"),
    ("/\\evil.com", "/"),
    ("http:/evil", "/"),
    (None, "/"),
    ("", "/"),
    ("/", "/"),
    ("/admin", "/admin"),
    ("/api/messages?folder=x", "/api/messages?folder=x"),
])
def test_safe_next(target, expected):
    assert safe_next(target) == expected


# ---------- integration (static mode) ----------

def test_static_login_and_session(app_client):
    csrf = login_static(app_client)
    assert csrf
    cfg = app_client.get("/api/config").get_json()
    assert cfg["is_admin"] is True


def test_api_requires_auth(app_client):
    assert app_client.get("/api/config").status_code == 401
    assert app_client.get("/api/messages").status_code == 401


def test_admin_gate(app_client):
    # not logged in -> 401 for api admin
    assert app_client.get("/api/admin/config").status_code == 401
    login_static(app_client)   # dev is admin
    assert app_client.get("/api/admin/config").status_code == 200


def test_csrf_required_on_post(app_client):
    csrf = login_static(app_client)
    # no token -> 400
    r = app_client.put("/api/prefs", json={"default_limit": 50})
    assert r.status_code == 400
    # with token -> ok
    r = app_client.put("/api/prefs", json={"default_limit": 50}, headers={"X-CSRF-Token": csrf})
    assert r.status_code == 200


def test_denied_user_static_forced_admin(app_client):
    # static mode forces admin regardless of users list, so login always succeeds.
    r = app_client.post("/login", data={"username": "dev", "password": "devpass"})
    assert r.status_code == 302  # redirect, not denied


def test_bad_static_credentials(app_client):
    r = app_client.post("/login", data={"username": "dev", "password": "wrong"})
    assert b"Invalid credentials" in r.data