import pytest
import bcrypt
from unittest.mock import AsyncMock, patch
from steward.models.users import User, UserRole


def make_user(role=UserRole.admin):
    return User(
        id="test-id",
        username="admin",
        email="admin@example.com",
        password_hash=bcrypt.hashpw(b"password", bcrypt.gensalt()).decode(),
        role=role,
        is_active=True,
        auth_source="local",
    )


async def with_csrf(client) -> dict:
    """Seed the session's forged-request token; returns the header to send."""
    async with client.session_transaction() as sess:
        sess["_csrf"] = "test-token"
    return {"X-CSRF-Token": "test-token"}


@pytest.mark.asyncio
async def test_login_page_returns_200(client):
    response = await client.get("/login")
    assert response.status_code == 200


@pytest.mark.asyncio
async def test_login_redirects_to_setup_when_no_users(client, app):
    with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=0)):
        response = await client.get("/login")
    assert response.status_code == 302
    assert "/setup" in response.headers["Location"]


@pytest.mark.asyncio
async def test_login_success_redirects_to_dashboard(client, app):
    user = make_user()
    headers = await with_csrf(client)
    with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
         patch("steward.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
        response = await client.post("/login", form={"username": "admin", "password": "password"},
                                     headers=headers)
    assert response.status_code == 302
    assert "/" in response.headers["Location"]


@pytest.mark.asyncio
async def test_login_failure_returns_400(client, app):
    user = make_user()
    headers = await with_csrf(client)
    with patch("steward.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
         patch("steward.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
        response = await client.post("/login", form={"username": "admin", "password": "wrong"},
                                     headers=headers)
    assert response.status_code == 400


@pytest.mark.asyncio
async def test_require_role_redirects_unauthenticated(client):
    response = await client.get("/")
    assert response.status_code == 302
    assert "/login" in response.headers["Location"]