"""Login gate: closed only once a password or Telegram login is configured."""

from __future__ import annotations

from app.services import auth_service


def test_open_by_default(client):
    assert client.get("/api/settings").status_code == 200


def test_password_hash_round_trips():
    hashed = auth_service.hash_password("correct horse battery staple")
    assert auth_service.verify_password("correct horse battery staple", hashed)
    assert not auth_service.verify_password("wrong", hashed)


def test_login_flow(client):
    from app.db import SessionLocal
    from app.services import settings_service

    db = SessionLocal()
    try:
        settings = settings_service.load_settings(db)
        settings.auth.password_hash = auth_service.hash_password("s3cret!!")
        settings_service.save_settings(db, settings)
    finally:
        db.close()

    # Locked out without a session.
    assert client.get("/api/settings").status_code == 401
    assert client.get("/api/auth/me").json()["login_required"] is True

    bad = client.post("/api/auth/login", json={"username": "timka", "password": "nope"})
    assert bad.status_code == 401

    ok = client.post("/api/auth/login", json={"username": "timka", "password": "s3cret!!"})
    assert ok.status_code == 200
    assert "kadence_session" in client.cookies

    assert client.get("/api/settings").status_code == 200
    assert client.get("/api/auth/me").json()["authenticated"] is True

    client.post("/api/auth/logout")
    assert client.get("/api/settings").status_code == 401


def test_api_token_still_works_once_login_is_configured(client, monkeypatch):
    from app.config import env_settings
    from app.db import SessionLocal
    from app.services import settings_service

    env_settings.cache_clear()
    monkeypatch.setenv("API_TOKEN", "desktop-secret")
    env_settings.cache_clear()

    db = SessionLocal()
    try:
        settings = settings_service.load_settings(db)
        settings.auth.password_hash = auth_service.hash_password("s3cret!!")
        settings_service.save_settings(db, settings)
    finally:
        db.close()

    assert client.get("/api/settings").status_code == 401
    assert client.get("/api/settings", headers={"X-API-Token": "desktop-secret"}).status_code == 200
    env_settings.cache_clear()