import pytest

from thoughtsync.app import create_app


@pytest.fixture
def app():
    return create_app()


async def test_create_device_requires_auth(app):
    # No session cookie and no bearer header → 401 before any DB access.
    client = app.test_client()
    resp = await client.post("/api/auth/devices", json={"name": "phone"})
    assert resp.status_code == 401


async def test_list_devices_requires_auth(app):
    client = app.test_client()
    resp = await client.get("/api/auth/devices")
    assert resp.status_code == 401


async def test_revoke_device_requires_auth(app):
    client = app.test_client()
    resp = await client.delete("/api/auth/devices/00000000-0000-0000-0000-000000000000")
    assert resp.status_code == 401


async def test_revoke_self_requires_auth(app):
    client = app.test_client()
    resp = await client.delete("/api/auth/devices/self")
    assert resp.status_code == 401


async def test_revoke_self_without_a_bearer_token_is_a_bad_request(app):
    # Doubles as the routing check: a session-authenticated caller presents no
    # device token, so the self-revoke view answers 400 BEFORE any DB access. A 404
    # here would mean "self" fell through to the id-keyed route as a malformed UUID
    # — i.e. that the static rule stopped winning.
    client = app.test_client()
    async with client.session_transaction() as sess:
        sess["user_id"] = "00000000-0000-0000-0000-000000000001"
    resp = await client.delete("/api/auth/devices/self")
    assert resp.status_code == 400


async def test_device_login_validates_input(app):
    # Missing credentials → 400 BEFORE any DB access, so it's checkable in the
    # DB-free unit lane (invalid-cred and success paths are operator-verified).
    client = app.test_client()
    resp = await client.post("/api/auth/device-login", json={})
    assert resp.status_code == 400