"""Auth endpoint and session tests."""

from __future__ import annotations

from auth import AUTH_HEADER, get_session
from tests.factories import provision_user_in_tenant


def test_login_logout_and_session(client):
    user = provision_user_in_tenant()

    login = client.post(
        "/api/auth/login",
        json={"email": user["email"], "password": user["password"]},
    )
    assert login.status_code == 200
    payload = login.json()
    assert "token" in payload
    assert payload["user"]["email"] == user["email"]
    token = payload["token"]

    me = client.get("/api/me", headers={AUTH_HEADER: token})
    assert me.status_code == 200
    assert me.json()["email"] == user["email"]
    assert me.json()["active_tenant_id"] == user["tenant_id"]

    logout = client.post("/api/auth/logout", headers={AUTH_HEADER: token})
    assert logout.status_code == 200
    assert get_session(token) is None

    me_after = client.get("/api/me", headers={AUTH_HEADER: token})
    assert me_after.status_code == 401


def test_login_invalid_password(client):
    user = provision_user_in_tenant()
    response = client.post(
        "/api/auth/login",
        json={"email": user["email"], "password": "wrong-password"},
    )
    assert response.status_code == 401


def test_me_requires_auth(client):
    assert client.get("/api/me").status_code == 401


def test_me_context_returns_tenant_and_actor(client):
    user = provision_user_in_tenant(tenant_role="admin")
    login = client.post(
        "/api/auth/login",
        json={"email": user["email"], "password": user["password"]},
    )
    token = login.json()["token"]

    ctx = client.get("/api/me/context", headers={AUTH_HEADER: token})
    assert ctx.status_code == 200
    body = ctx.json()
    assert body["tenant"]["id"] == user["tenant_id"]
    assert body["tenant"]["role"] == "admin"
    assert body["actor"]["id"] == user["actor_id"]
    assert body["actor"]["type"] == "human"


def test_tenant_switch_rejects_invalid_membership(client):
    user = provision_user_in_tenant()
    other = provision_user_in_tenant()

    login = client.post(
        "/api/auth/login",
        json={"email": user["email"], "password": user["password"]},
    )
    token = login.json()["token"]

    switch = client.post(
        "/api/me/tenant",
        headers={AUTH_HEADER: token},
        json={"tenant_id": other["tenant_id"]},
    )
    assert switch.status_code == 403