from sqlalchemy import select

from app.auth.models import User


def register(client, **overrides):
    data = {
        "username": "steady_user",
        "email": "person@example.com",
        "password": "a calm secure password",
        "confirm_password": "a calm secure password",
    }
    data.update(overrides)
    return client.post("/auth/register", data=data, follow_redirects=True)


def test_registration_hashes_password(client, db):
    response = register(client)
    user = db.session.scalar(select(User).where(User.email == "person@example.com"))

    assert response.status_code == 200
    assert b"Your account is ready" in response.data
    assert user is not None
    assert user.password_hash != "a calm secure password"
    assert user.check_password("a calm secure password")


def test_registration_rejects_duplicate_identity(client):
    register(client)
    response = register(client, email="another@example.com")

    assert b"That username or email is already registered" in response.data


def test_login_and_logout(client):
    register(client)

    login_response = client.post(
        "/auth/login",
        data={
            "email": "person@example.com",
            "password": "a calm secure password",
        },
        follow_redirects=True,
    )
    assert b"Hi, steady_user" in login_response.data

    logout_response = client.post("/auth/logout", follow_redirects=True)
    assert b"You have been signed out" in logout_response.data
    assert b"Create account" in logout_response.data


def test_login_uses_generic_failure_message(client):
    response = client.post(
        "/auth/login",
        data={"email": "missing@example.com", "password": "incorrect"},
    )

    assert b"Email or password is incorrect" in response.data


def test_external_next_url_is_not_used(client):
    register(client)
    response = client.post(
        "/auth/login?next=https://attacker.example/",
        data={
            "email": "person@example.com",
            "password": "a calm secure password",
        },
    )

    assert response.headers["Location"] == "/"