import pytest

from inkwell.app import create_app


@pytest.fixture
def app():
    return create_app()


async def test_create_device_requires_auth(app):
    # No session cookie and no bearer header → 401 before any DB access.
    client = app.test_client()
    resp = await client.post("/api/auth/devices", json={"name": "phone"})
    assert resp.status_code == 401


async def test_list_devices_requires_auth(app):
    client = app.test_client()
    resp = await client.get("/api/auth/devices")
    assert resp.status_code == 401


async def test_revoke_device_requires_auth(app):
    client = app.test_client()
    resp = await client.delete("/api/auth/devices/00000000-0000-0000-0000-000000000000")
    assert resp.status_code == 401


async def test_revoke_self_requires_auth(app):
    client = app.test_client()
    resp = await client.delete("/api/auth/devices/self")
    assert resp.status_code == 401


def test_revoke_self_routes_to_the_self_revoke_view(app):
    # The static rule must win over `/devices/<device_id>`: if "self" fell through to
    # the id-keyed route it would be read as a malformed UUID and answer 404. Checked
    # on the URL map, because every route behind login_required now reads the
    # account's session epoch (#5173). The view's 400 for a caller with no bearer
    # token is in test_integration.py.
    endpoint, _ = app.url_map.bind("localhost").match("/api/auth/devices/self", method="DELETE")
    assert endpoint == "auth.revoke_own_device"


async def test_device_login_validates_input(app):
    # Missing credentials → 400 BEFORE any DB access, so it's checkable in the
    # DB-free unit lane (invalid-cred and success paths are operator-verified).
    client = app.test_client()
    resp = await client.post("/api/auth/device-login", json={})
    assert resp.status_code == 400