import os
import sys
from collections.abc import Generator
from pathlib import Path
from unittest.mock import patch

import pytest
from fastapi.testclient import TestClient

from pygitweb.auth_config import AuthConfig, LocalUser
from pygitweb.config import settings
from pygitweb.main import app

_LOCAL_ADMIN = AuthConfig(
	auth_mode="local",
	local_users=[LocalUser(user="admin", password="secret")],
)


@pytest.fixture
def client() -> Generator[TestClient, None, None]:
	with TestClient(app) as c:
		yield c


@pytest.fixture
def local_auth_config() -> Generator[AuthConfig, None, None]:
	with (
		patch("pygitweb.auth_config.auth_config", _LOCAL_ADMIN),
		patch("pygitweb.auth.auth_config", _LOCAL_ADMIN),
		patch("pygitweb.main.auth_config", _LOCAL_ADMIN),
	):
		yield _LOCAL_ADMIN


def test_token_disabled(client: TestClient) -> None:
	with patch.object(settings, "AUTH", False):
		r = client.post("/token", data={"username": "a", "password": "b"})
		assert r.status_code == 400
		assert r.json()["detail"] == "Authentication is disabled"


def test_token_success(client: TestClient, local_auth_config: AuthConfig) -> None:
	with patch.object(settings, "AUTH", True):
		r = client.post("/token", data={"username": "admin", "password": "secret"})
	assert r.status_code == 200
	data = r.json()
	assert data["token_type"] == "bearer"
	assert isinstance(data["access_token"], str)
	assert len(data["access_token"]) >= 32
	assert data["access_token"] != "admin"


def test_token_wrong_password(client: TestClient, local_auth_config: AuthConfig) -> None:
	with patch.object(settings, "AUTH", True):
		r = client.post("/token", data={"username": "admin", "password": "wrong"})
	assert r.status_code == 400


def test_users_me_with_bearer(client: TestClient, local_auth_config: AuthConfig) -> None:
	with patch.object(settings, "AUTH", True):
		tok = client.post("/token", data={"username": "admin", "password": "secret"}).json()["access_token"]
		r = client.get("/users/me", headers={"Authorization": f"Bearer {tok}"})
		assert r.status_code == 200
		assert r.json()["username"] == "admin"


def test_login_form_sets_cookie_and_users_me(client: TestClient, local_auth_config: AuthConfig) -> None:
	with patch.object(settings, "AUTH", True):
		r = client.post(
			"/login",
			data={"username": "admin", "password": "secret", "next": "/"},
			follow_redirects=False,
		)
		assert r.status_code == 303
		r2 = client.get("/users/me")
		assert r2.status_code == 200
		assert r2.json()["username"] == "admin"


def test_logout_revokes_cookie_session(client: TestClient, local_auth_config: AuthConfig) -> None:
	with patch.object(settings, "AUTH", True):
		client.post(
			"/login",
			data={"username": "admin", "password": "secret", "next": "/"},
			follow_redirects=False,
		)
		assert client.get("/users/me").status_code == 200
		r_out = client.get("/logout", params={"next": "/"}, follow_redirects=False)
		assert r_out.status_code == 303
		assert client.get("/users/me").status_code == 401


def test_logout_with_bearer_revokes_token(client: TestClient, local_auth_config: AuthConfig) -> None:
	with patch.object(settings, "AUTH", True):
		tok = client.post("/token", data={"username": "admin", "password": "secret"}).json()["access_token"]
		headers = {"Authorization": f"Bearer {tok}"}
		assert client.get("/users/me", headers=headers).status_code == 200
		r_out = client.get("/logout", params={"next": "/"}, headers=headers, follow_redirects=False)
		assert r_out.status_code == 303
		assert client.get("/users/me", headers=headers).status_code == 401


def test_projectnamevalid_no_auth_required_when_auth_disabled(client: TestClient) -> None:
	with patch.object(settings, "AUTH", False), patch("pygitweb.main.project_visible_in_list", return_value=False):
		r = client.get("/projectnamevalid", params={"name": "newproj"})
	assert r.status_code == 200


def test_projectnamevalid_401_without_credentials_when_auth_enabled(
	client: TestClient, local_auth_config: AuthConfig
) -> None:
	with patch.object(settings, "AUTH", True):
		r = client.get("/projectnamevalid", params={"name": "newproj"})
	assert r.status_code == 401


def test_projectnamevalid_ok_with_bearer_when_auth_enabled(client: TestClient, local_auth_config: AuthConfig) -> None:
	with (
		patch.object(settings, "AUTH", True),
		patch("pygitweb.main.project_visible_in_list", return_value=False),
	):
		tok = client.post("/token", data={"username": "admin", "password": "secret"}).json()["access_token"]
		r = client.get(
			"/projectnamevalid",
			params={"name": "newproj"},
			headers={"Authorization": f"Bearer {tok}"},
		)
	assert r.status_code == 200


def test_auth_config_init_creates_file_only_when_auth_enabled(tmp_path: Path) -> None:
	from pygitweb.auth_config import init_auth_config
	from pygitweb.config import Settings

	cfg_path = tmp_path / "auth.json"
	s = Settings(AUTH=True, AUTH_CONFIG=str(cfg_path))
	assert not cfg_path.is_file()
	cfg = init_auth_config(s)
	assert cfg_path.is_file()
	assert cfg.local_users[0].user == "admin"
	assert len(cfg.local_users[0].password) >= 8
	if sys.platform != "win32":
		assert oct(os.stat(cfg_path).st_mode & 0o777) == "0o600"


def test_auth_config_no_file_when_auth_disabled(tmp_path: Path) -> None:
	from pygitweb.auth_config import init_auth_config
	from pygitweb.config import Settings

	cfg_path = tmp_path / "auth.json"
	s = Settings(AUTH=False, AUTH_CONFIG=str(cfg_path))
	init_auth_config(s)
	assert not cfg_path.is_file()


def test_auth_config_does_not_regenerate_missing_password(tmp_path: Path) -> None:
	from pygitweb.auth_config import init_auth_config, write_auth_config
	from pygitweb.config import Settings

	cfg_path = tmp_path / "auth.json"
	write_auth_config(
		cfg_path,
		AuthConfig(auth_mode="local", local_users=[LocalUser(user="admin", password="")]),
	)
	s = Settings(AUTH=True, AUTH_CONFIG=str(cfg_path))
	cfg = init_auth_config(s)
	assert cfg.local_users[0].password == ""


@pytest.mark.skipif(sys.platform == "win32", reason="Unix file modes")
def test_auth_config_rejects_insecure_permissions(tmp_path: Path) -> None:
	from pygitweb.auth_config import AuthConfigPermissionError, init_auth_config, write_auth_config
	from pygitweb.config import Settings

	cfg_path = tmp_path / "auth.json"
	write_auth_config(
		cfg_path,
		AuthConfig(auth_mode="local", local_users=[LocalUser(user="admin", password="secret")]),
	)
	os.chmod(cfg_path, 0o644)
	s = Settings(AUTH=True, AUTH_CONFIG=str(cfg_path))
	with pytest.raises(AuthConfigPermissionError, match="0600"):
		init_auth_config(s)