import httpx
import respx
from starlette.testclient import TestClient

from resonance_engine.config import settings

from tests.unit.helpers import override_settings


def test_login_redirects_to_auth0_and_sets_state(client: TestClient) -> None:
    client.cookies.clear()

    with override_settings(auth0_domain="test.auth0.com", auth0_client_id="cid"):
        response = client.get("/auth/login", follow_redirects=False)

    assert response.status_code == 307
    assert response.headers["location"].startswith("https://test.auth0.com/authorize?")
    assert response.cookies.get("oauth_state")


def test_callback_rejects_bad_state(client: TestClient) -> None:
    client.cookies.clear()
    client.cookies.set("oauth_state", "good")

    response = client.get("/oauth2/callback?code=abc&state=bad", follow_redirects=False)

    assert response.status_code == 400


def test_callback_shows_error_page_on_auth0_error(client: TestClient) -> None:
    response = client.get(
        "/oauth2/callback?error=invalid_request"
        "&error_description=no+connections+enabled+for+the+client",
        follow_redirects=False,
    )

    assert response.status_code == 400
    assert "no connections enabled for the client" in response.text


def test_callback_error_page_escapes_reflected_params(client: TestClient) -> None:
    response = client.get("/oauth2/callback?error=%3Cscript%3E", follow_redirects=False)

    assert response.status_code == 400
    assert "<script>" not in response.text
    assert "&lt;script&gt;" in response.text


def test_callback_shows_error_page_when_code_missing(client: TestClient) -> None:
    response = client.get("/oauth2/callback?state=s", follow_redirects=False)

    assert response.status_code == 400
    assert "Missing code or state" in response.text


@respx.mock
def test_callback_exchanges_code_and_sets_session(client: TestClient) -> None:
    client.cookies.clear()
    route = respx.post("https://test.auth0.com/oauth/token").mock(
        return_value=httpx.Response(
            200, json={"id_token": "jwt-token", "expires_in": 3600}
        )
    )
    client.cookies.set("oauth_state", "s123")

    with override_settings(auth0_domain="test.auth0.com"):
        response = client.get(
            "/oauth2/callback?code=abc&state=s123", follow_redirects=False
        )

    assert route.called
    assert response.status_code == 307
    assert response.headers["location"] == settings.auth0_post_login_redirect
    assert response.cookies.get(settings.session_cookie_name) == "jwt-token"


@respx.mock
def test_callback_returns_401_when_token_exchange_fails(client: TestClient) -> None:
    client.cookies.clear()
    respx.post("https://test.auth0.com/oauth/token").mock(
        return_value=httpx.Response(403)
    )
    client.cookies.set("oauth_state", "s")

    with override_settings(auth0_domain="test.auth0.com"):
        response = client.get(
            "/oauth2/callback?code=abc&state=s", follow_redirects=False
        )

    assert response.status_code == 401


def test_refresh_returns_401_without_cookie(client: TestClient) -> None:
    client.cookies.clear()

    response = client.post("/auth/refresh")

    assert response.status_code == 401


@respx.mock
def test_refresh_sets_new_session_cookie(client: TestClient) -> None:
    client.cookies.clear()
    respx.post("https://test.auth0.com/oauth/token").mock(
        return_value=httpx.Response(
            200, json={"id_token": "new-jwt", "expires_in": 3600}
        )
    )
    client.cookies.set("refresh_token", "rt")

    with override_settings(auth0_domain="test.auth0.com"):
        response = client.post("/auth/refresh")

    assert response.status_code == 204
    assert response.cookies.get(settings.session_cookie_name) == "new-jwt"


def test_logout_clears_cookie_and_redirects_to_auth0(client: TestClient) -> None:
    client.cookies.clear()

    with override_settings(auth0_domain="test.auth0.com"):
        response = client.get("/auth/logout", follow_redirects=False)

    assert response.status_code == 307
    assert response.headers["location"].startswith("https://test.auth0.com/v2/logout?")


def test_me_returns_401_without_session_cookie(client: TestClient) -> None:
    client.cookies.clear()

    with override_settings(auth_enabled=True):
        response = client.get("/auth/me")

    assert response.status_code == 401


def test_me_returns_dev_identity_when_auth_disabled(client: TestClient) -> None:
    with override_settings(auth_enabled=False):
        response = client.get("/auth/me")

    assert response.status_code == 200
    assert response.json() == {"email": "dev@localhost", "name": "Dev"}