benevoles/backend/tests/test_forms_api.py

"""Formulaire public d'inscription : configuration (COORDINATION) et
soumission publique (aucune authentification)."""

import base64
import datetime as dt
import io

from app.auth.rate_limit import form_submission_limiter
from app.models import Role
from tests.factories import make_artist, make_position

# PNG 1×1 valide (transparent), le plus petit possible.
_PNG = base64.b64decode(
    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY"
    "42YAAAAASUVORK5CYII="
)


def _form_url(edition, suffix=""):
    return f"/editions/{edition.id}/form{suffix}"


def _submit(client, edition, **fields):
    return client.post(_form_url(edition, "/public/submit"), data=fields)


def test_config_starts_open_with_no_fields(client, edition):
    resp = client.get(_form_url(edition))
    assert resp.status_code == 200
    body = resp.json()
    assert body["is_open"] is True
    assert body["fields"] == []


def test_config_is_coordinator_only(edition, make_account, as_account):
    lead = make_account(Role.LEAD, email="lead@e.fr")
    lead_client = as_account(lead)
    assert lead_client.get(_form_url(edition)).status_code == 403
    resp = lead_client.put(_form_url(edition, "/fields"), json={"fields": []})
    assert resp.status_code == 403


def test_setting_fields_replaces_them_entirely(client, edition):
    resp = client.put(
        _form_url(edition, "/fields"),
        json={"fields": ["EMAIL", "PHONE", "PHOTO"]},
    )
    assert resp.status_code == 200
    assert sorted(resp.json()["fields"]) == ["EMAIL", "PHONE", "PHOTO"]

    # Un second PUT remplace, ne cumule pas.
    resp = client.put(_form_url(edition, "/fields"), json={"fields": ["EMAIL"]})
    assert resp.json()["fields"] == ["EMAIL"]


def test_closing_the_form(client, edition):
    resp = client.patch(_form_url(edition), json={"is_open": False})
    assert resp.status_code == 200
    assert resp.json()["is_open"] is False


def test_setting_description_does_not_touch_is_open(client, edition):
    client.patch(_form_url(edition), json={"is_open": False})
    resp = client.patch(_form_url(edition), json={"description": "Bienvenue !"})
    assert resp.status_code == 200
    assert resp.json()["description"] == "Bienvenue !"
    assert resp.json()["is_open"] is False  # inchangé, absent du corps


def test_clearing_description_with_an_explicit_null(client, edition):
    client.patch(_form_url(edition), json={"description": "Bienvenue !"})
    resp = client.patch(_form_url(edition), json={"description": None})
    assert resp.status_code == 200
    assert resp.json()["description"] is None


def test_logo_is_coordinator_only(edition, make_account, as_account):
    lead = make_account(Role.LEAD, email="lead@e.fr")
    lead_client = as_account(lead)
    resp = lead_client.put(
        _form_url(edition, "/logo"), files={"file": ("logo.png", io.BytesIO(_PNG), "image/png")}
    )
    assert resp.status_code == 403


def test_no_logo_by_default(client, raw_client, edition):
    assert client.get(_form_url(edition)).json()["has_logo"] is False
    resp = raw_client.get(_form_url(edition, "/logo"))
    assert resp.status_code == 404


def test_uploading_a_logo_and_reading_it_back_publicly(client, raw_client, edition):
    resp = client.put(
        _form_url(edition, "/logo"), files={"file": ("logo.png", io.BytesIO(_PNG), "image/png")}
    )
    assert resp.status_code == 200
    assert resp.json()["has_logo"] is True

    assert client.get(_form_url(edition)).json()["has_logo"] is True

    logo = raw_client.get(_form_url(edition, "/logo"))
    assert logo.status_code == 200
    assert logo.headers["content-type"] == "image/png"
    assert logo.content == _PNG


def test_uploading_an_unsupported_logo_type_is_rejected(client, edition):
    resp = client.put(
        _form_url(edition, "/logo"),
        files={"file": ("logo.gif", b"not-a-real-gif", "image/gif")},
    )
    assert resp.status_code == 422
    assert resp.json()["detail"]["code"] == "form.logo_type_not_supported"


def test_public_config_reports_the_logo_and_description(client, raw_client, edition):
    client.patch(_form_url(edition), json={"description": "Bienvenue au festival !"})
    client.put(
        _form_url(edition, "/logo"), files={"file": ("logo.png", io.BytesIO(_PNG), "image/png")}
    )

    body = raw_client.get(_form_url(edition, "/public")).json()
    assert body["description"] == "Bienvenue au festival !"
    assert body["has_logo"] is True


def test_public_form_hides_positions_and_artists_unless_enabled(
    client, raw_client, edition, session
):
    make_position(session, edition, name="Bar central")
    make_artist(session, edition, name="Chilla")

    resp = raw_client.get(_form_url(edition, "/public"))
    body = resp.json()
    assert body["positions"] == []
    assert body["artists"] == []

    client.put(
        _form_url(edition, "/fields"),
        json={"fields": ["POSITION_WISHES", "ARTIST_WISHES"]},
    )
    resp = raw_client.get(_form_url(edition, "/public"))
    body = resp.json()
    assert [p["name"] for p in body["positions"]] == ["Bar central"]
    assert [a["name"] for a in body["artists"]] == ["Chilla"]


def test_submitting_creates_a_volunteer(raw_client, client, edition, session):
    client.put(
        _form_url(edition, "/fields"),
        json={"fields": ["EMAIL", "PHONE", "AVAILABLE", "WILLING_TO_PAY_FEE"]},
    )
    resp = _submit(
        raw_client, edition,
        first_name="alex", last_name="martin", hcaptcha_token="x",
        email="alex@example.org", phone="0600000000",
        available="true", willing_to_pay_fee="true",
    )
    assert resp.status_code == 201
    volunteer_id = resp.json()["volunteer_id"]

    fiche = client.get(f"/editions/{edition.id}/volunteers/{volunteer_id}").json()
    assert fiche["first_name"] == "Alex"
    assert fiche["last_name"] == "Martin"
    assert fiche["email"] == "alex@example.org"
    assert fiche["self_declared_available"] is True
    assert fiche["willing_to_pay_fee"] is True

    # Le bénévole créé apparaît dans la liste de la coordination.
    volunteers = client.get(f"/editions/{edition.id}/volunteers").json()
    assert any(v["id"] == volunteer_id for v in volunteers)


def test_submitting_ignores_fields_not_enabled(raw_client, client, edition):
    # Aucun champ activé : email/téléphone envoyés quand même, ignorés.
    resp = _submit(
        raw_client, edition,
        first_name="Alex", last_name="Martin", hcaptcha_token="x",
        email="alex@example.org", phone="0600000000",
    )
    assert resp.status_code == 201
    volunteer_id = resp.json()["volunteer_id"]
    fiche = client.get(f"/editions/{edition.id}/volunteers/{volunteer_id}").json()
    assert fiche["email"] is None
    assert fiche["phone"] is None


def test_submitting_resolves_position_and_artist_wishes(
    raw_client, client, edition, session
):
    position = make_position(session, edition, name="Bar central")
    artist = make_artist(session, edition, name="Chilla")
    client.put(
        _form_url(edition, "/fields"),
        json={"fields": ["POSITION_WISHES", "ARTIST_WISHES", "COMPANION_WISH"]},
    )
    resp = _submit(
        raw_client, edition,
        first_name="Alex", last_name="Martin", hcaptcha_token="x",
        position_wish_ids=f'["{position.id}"]',
        artist_wish_ids=f'["{artist.id}"]',
        companion_wish_note="Sam, il/elle s'inscrira bientôt",
    )
    assert resp.status_code == 201
    volunteer_id = resp.json()["volunteer_id"]
    fiche = client.get(f"/editions/{edition.id}/volunteers/{volunteer_id}").json()
    assert fiche["wished_position_ids"] == [str(position.id)]
    assert fiche["artist_ids"] == [str(artist.id)]
    assert fiche["companion_wish_note"] == "Sam, il/elle s'inscrira bientôt"


def test_submitting_with_a_photo(raw_client, client, edition):
    client.put(_form_url(edition, "/fields"), json={"fields": ["PHOTO"]})
    resp = raw_client.post(
        _form_url(edition, "/public/submit"),
        data={"first_name": "Alex", "last_name": "Martin", "hcaptcha_token": "x"},
        files={"photo": ("selfie.png", io.BytesIO(_PNG), "image/png")},
    )
    assert resp.status_code == 201
    volunteer_id = resp.json()["volunteer_id"]
    fiche = client.get(f"/editions/{edition.id}/volunteers/{volunteer_id}").json()
    assert fiche["has_photo"] is True

    photo = client.get(f"/editions/{edition.id}/volunteers/{volunteer_id}/photo")
    assert photo.status_code == 200
    assert photo.headers["content-type"] == "image/png"
    assert photo.content == _PNG


def test_submitting_an_unsupported_photo_type_is_rejected(raw_client, client, edition):
    client.put(_form_url(edition, "/fields"), json={"fields": ["PHOTO"]})
    resp = raw_client.post(
        _form_url(edition, "/public/submit"),
        data={"first_name": "Alex", "last_name": "Martin", "hcaptcha_token": "x"},
        files={"photo": ("selfie.gif", b"not-a-real-gif", "image/gif")},
    )
    assert resp.status_code == 422
    assert resp.json()["detail"]["code"] == "form.photo_type_not_supported"


def test_submitting_more_than_two_position_wishes_is_rejected(
    raw_client, client, edition, session
):
    positions = [
        make_position(session, edition, name=f"Poste {i}") for i in range(3)
    ]
    ids = "[" + ",".join(f'"{p.id}"' for p in positions) + "]"
    client.put(_form_url(edition, "/fields"), json={"fields": ["POSITION_WISHES"]})
    resp = _submit(
        raw_client, edition,
        first_name="Alex", last_name="Martin", hcaptcha_token="x",
        position_wish_ids=ids,
    )
    assert resp.status_code == 422
    assert resp.json()["detail"]["code"] == "form.too_many_position_wishes"


def test_submitting_two_position_wishes_is_accepted(raw_client, client, edition, session):
    positions = [make_position(session, edition, name=f"Poste {i}") for i in range(2)]
    client.put(_form_url(edition, "/fields"), json={"fields": ["POSITION_WISHES"]})
    ids = "[" + ",".join(f'"{p.id}"' for p in positions) + "]"
    resp = _submit(
        raw_client, edition,
        first_name="Alex", last_name="Martin", hcaptcha_token="x",
        position_wish_ids=ids,
    )
    assert resp.status_code == 201


def test_submitting_two_artist_wishes_on_the_same_day_is_rejected(
    raw_client, client, edition, session
):
    a1 = make_artist(session, edition, name="Chilla")
    a2 = make_artist(session, edition, name="Kntongo")  # même jour par défaut
    client.put(_form_url(edition, "/fields"), json={"fields": ["ARTIST_WISHES"]})
    resp = _submit(
        raw_client, edition,
        first_name="Alex", last_name="Martin", hcaptcha_token="x",
        artist_wish_ids=f'["{a1.id}", "{a2.id}"]',
    )
    assert resp.status_code == 422
    assert resp.json()["detail"]["code"] == "form.too_many_artists_same_day"


def test_submitting_artist_wishes_on_different_days_is_accepted(
    raw_client, client, edition, session
):
    a1 = make_artist(session, edition, name="Chilla", performance_date=dt.date(2026, 7, 9))
    a2 = make_artist(session, edition, name="Kntongo", performance_date=dt.date(2026, 7, 10))
    client.put(_form_url(edition, "/fields"), json={"fields": ["ARTIST_WISHES"]})
    resp = _submit(
        raw_client, edition,
        first_name="Alex", last_name="Martin", hcaptcha_token="x",
        artist_wish_ids=f'["{a1.id}", "{a2.id}"]',
    )
    assert resp.status_code == 201


def test_submitting_a_comment(raw_client, client, edition):
    client.put(_form_url(edition, "/fields"), json={"fields": ["COMMENT"]})
    resp = _submit(
        raw_client, edition,
        first_name="Alex", last_name="Martin", hcaptcha_token="x",
        comment="Dispo seulement le samedi",
    )
    assert resp.status_code == 201
    volunteer_id = resp.json()["volunteer_id"]
    fiche = client.get(f"/editions/{edition.id}/volunteers/{volunteer_id}").json()
    assert fiche["comment"] == "Dispo seulement le samedi"


def test_submitting_with_an_unknown_position_id_is_rejected(raw_client, client, edition):
    client.put(_form_url(edition, "/fields"), json={"fields": ["POSITION_WISHES"]})
    resp = _submit(
        raw_client, edition,
        first_name="Alex", last_name="Martin", hcaptcha_token="x",
        position_wish_ids='["00000000-0000-0000-0000-000000000000"]',
    )
    assert resp.status_code == 422
    assert resp.json()["detail"]["code"] == "position.unknown"


def test_submitting_when_the_form_is_closed_is_rejected(raw_client, client, edition):
    client.patch(_form_url(edition), json={"is_open": False})
    resp = _submit(
        raw_client, edition, first_name="Alex", last_name="Martin", hcaptcha_token="x"
    )
    assert resp.status_code == 422
    assert resp.json()["detail"]["code"] == "form.closed"


def test_submitting_with_a_rejected_captcha(raw_client, edition, monkeypatch):
    monkeypatch.setattr("app.api.forms.verify_hcaptcha", lambda token: False)
    resp = _submit(
        raw_client, edition, first_name="Alex", last_name="Martin", hcaptcha_token="x"
    )
    assert resp.status_code == 422
    assert resp.json()["detail"]["code"] == "form.captcha_failed"


def test_submitting_is_rate_limited_per_edition(raw_client, edition):
    for _ in range(form_submission_limiter.max_attempts):
        form_submission_limiter.hit(str(edition.id))
    resp = _submit(
        raw_client, edition, first_name="Alex", last_name="Martin", hcaptcha_token="x"
    )
    assert resp.status_code == 429