import datetime as dt
import logging

from sqlmodel import select

from app.auth.tokens import hash_token
from app.models import MagicLinkToken, Role, local_now


def _url(edition, suffix):
    return f"/editions/{edition.id}/auth/{suffix}"


def test_magic_link_unknown_email_is_accepted_without_token(
    raw_client, session, edition
):
    resp = raw_client.post(
        _url(edition, "magic-link"), json={"email": "personne@example.fr"}
    )
    assert resp.status_code == 202
    assert session.exec(select(MagicLinkToken)).all() == []


def test_full_flow_magic_link_then_jwt_then_me(
    raw_client, session, edition, make_account, caplog
):
    make_account(Role.LEAD, email="ref@example.fr")

    with caplog.at_level(logging.INFO, logger="app.auth"):
        resp = raw_client.post(
            _url(edition, "magic-link"), json={"email": "REF@example.fr"}
        )
    assert resp.status_code == 202
    log_line = next(m for m in caplog.messages if "Lien magique" in m)
    raw_token = log_line.split("jeton=")[-1].strip()

    verified = raw_client.post(
        _url(edition, "verify"), json={"token": raw_token}
    )
    assert verified.status_code == 200
    body = verified.json()
    assert body["token_type"] == "bearer"
    assert body["account"]["role"] == "LEAD"
    assert body["account"]["auth_method"] == "magic_link"

    me = raw_client.get(
        "/auth/me",
        headers={"Authorization": f"Bearer {body['access_token']}"},
    )
    assert me.status_code == 200
    assert me.json()["email"] == "ref@example.fr"


def test_verify_is_single_use(raw_client, session, edition, make_account):
    account = make_account(Role.VOLUNTEER, email="v@example.fr")
    session.add(
        MagicLinkToken(
            account_id=account.id,
            token_hash=hash_token("jeton-connu"),
            expires_at=local_now() + dt.timedelta(minutes=10),
        )
    )
    session.commit()

    first = raw_client.post(_url(edition, "verify"), json={"token": "jeton-connu"})
    assert first.status_code == 200
    second = raw_client.post(
        _url(edition, "verify"), json={"token": "jeton-connu"}
    )
    assert second.status_code == 401
    assert second.json()["detail"]["code"] == "auth.invalid_token"


def test_verify_rejects_expired_token(raw_client, session, edition, make_account):
    account = make_account(Role.VOLUNTEER, email="v@example.fr")
    session.add(
        MagicLinkToken(
            account_id=account.id,
            token_hash=hash_token("perime"),
            expires_at=local_now() - dt.timedelta(minutes=1),
        )
    )
    session.commit()
    resp = raw_client.post(_url(edition, "verify"), json={"token": "perime"})
    assert resp.status_code == 401


def test_verify_rejects_unknown_token(raw_client, edition):
    resp = raw_client.post(_url(edition, "verify"), json={"token": "n'importe"})
    assert resp.status_code == 401


def test_me_requires_a_valid_bearer(raw_client):
    assert raw_client.get("/auth/me").status_code == 401
    assert (
        raw_client.get(
            "/auth/me", headers={"Authorization": "Bearer pas-un-jwt"}
        ).status_code
        == 401
    )