import pytest

from thoughtsync.app import create_app


@pytest.fixture
def app():
    return create_app()


async def test_create_device_requires_auth(app):
    # No session cookie and no bearer header → 401 before any DB access.
    client = app.test_client()
    resp = await client.post("/api/auth/devices", json={"name": "phone"})
    assert resp.status_code == 401


async def test_list_devices_requires_auth(app):
    client = app.test_client()
    resp = await client.get("/api/auth/devices")
    assert resp.status_code == 401


async def test_revoke_device_requires_auth(app):
    client = app.test_client()
    resp = await client.delete("/api/auth/devices/00000000-0000-0000-0000-000000000000")
    assert resp.status_code == 401


async def test_device_login_validates_input(app):
    # Missing credentials → 400 BEFORE any DB access, so it's checkable in the
    # DB-free unit lane (invalid-cred and success paths are operator-verified).
    client = app.test_client()
    resp = await client.post("/api/auth/device-login", json={})
    assert resp.status_code == 400