import pytest
from httpx import AsyncClient

from app.core.security import create_access_token


class TestLogin:
    async def test_login_success(self, client: AsyncClient, admin_user):
        resp = await client.post("/api/v1/auth/login", json={
            "username": "admin",
            "password": "123456",
        })
        assert resp.status_code == 200
        data = resp.json()
        assert "access_token" in data
        assert data["token_type"] == "bearer"
        assert data["user"]["username"] == "admin"
        assert data["user"]["role"] == "admin"

    async def test_login_wrong_password(self, client: AsyncClient, admin_user):
        resp = await client.post("/api/v1/auth/login", json={
            "username": "admin",
            "password": "wrong",
        })
        assert resp.status_code == 401

    async def test_login_nonexistent_user(self, client: AsyncClient):
        resp = await client.post("/api/v1/auth/login", json={
            "username": "nobody",
            "password": "123456",
        })
        assert resp.status_code == 401

    async def test_login_disabled_user(self, client: AsyncClient, disabled_user):
        resp = await client.post("/api/v1/auth/login", json={
            "username": "disabled",
            "password": "123456",
        })
        assert resp.status_code == 403


class TestGetMe:
    async def test_get_me_no_token(self, client: AsyncClient):
        resp = await client.get("/api/v1/auth/me")
        assert resp.status_code in (401, 403)

    async def test_get_me_valid_token(self, client: AsyncClient, admin_user, admin_token):
        resp = await client.get(
            "/api/v1/auth/me",
            headers={"Authorization": f"Bearer {admin_token}"},
        )
        assert resp.status_code == 200
        data = resp.json()
        assert data["username"] == "admin"
        assert "id" in data
        assert "role" in data

    async def test_get_me_expired_token(self, client: AsyncClient, admin_user):
        from datetime import timedelta
        expired = create_access_token(
            data={"sub": str(admin_user.id), "role": admin_user.role},
            expires_delta=timedelta(seconds=-1),
        )
        resp = await client.get(
            "/api/v1/auth/me",
            headers={"Authorization": f"Bearer {expired}"},
        )
        assert resp.status_code == 401


class TestLogout:
    async def test_logout(self, client: AsyncClient, admin_token):
        resp = await client.post(
            "/api/v1/auth/logout",
            headers={"Authorization": f"Bearer {admin_token}"},
        )
        assert resp.status_code == 200