# -*- coding: utf-8 -*-
"""注册/找回/卡密端点的沙箱测试（不触碰生产 data/site.db）。

直接向沙箱库 email_codes 表播种验证码，绕过 SMTP，覆盖：
- 注册协议门槛、用户名/密码长度校验
- 注册成功路径：建号 + 赠送次数 + 签发可用会话 Cookie
- 验证码错误分支
- 找回密码：重置后可用新密码登录、旧会话失效
- 卡密充值
"""
import asyncio
import sqlite3
import time

import pytest
from fastapi.testclient import TestClient

import auth_system as auth
import core.db as db

SECRET = 'register-test-secret'


async def _fake_secret_key() -> str:
    return SECRET


def _connect() -> sqlite3.Connection:
    """直连沙箱库做只读/播种（auth.get_conn 已异步化，测试用裸连接更直接）。"""
    conn = sqlite3.connect(str(auth.db.DB_PATH))
    conn.row_factory = sqlite3.Row
    return conn


@pytest.fixture()
def env(tmp_path, monkeypatch):
    db_path = tmp_path / 'site.db'
    monkeypatch.setattr(auth.db, 'DATA_DIR', tmp_path)
    monkeypatch.setattr(auth.db, 'DB_PATH', db_path)
    monkeypatch.setattr(auth.db, 'BACKUP_DIR', tmp_path / 'backups')
    monkeypatch.setattr(auth.db, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
    monkeypatch.setattr(db, 'DATA_DIR', tmp_path)
    monkeypatch.setattr(db, 'DB_PATH', db_path)
    asyncio.run(auth.init_db())
    monkeypatch.setattr('web.deps.secret_key', _fake_secret_key)
    import web.auth_state as auth_routes
    auth_routes._SEND_CODE_IP.clear()
    from web.app import create_app
    return TestClient(create_app())


def _seed_code(email: str, code: str, purpose: str = 'register'):
    conn = _connect()
    conn.execute('DELETE FROM email_codes WHERE email = ? AND purpose = ?', (email, purpose))
    conn.execute('INSERT INTO email_codes (email, code, expires_at, created_at, purpose) '
                 'VALUES (?, ?, ?, ?, ?)',
                 (email, code, int(time.time()) + 600, int(time.time()), purpose))
    conn.commit()
    conn.close()


def test_register_requires_agreement(env):
    r = env.post('/auth/register', json={
        'username': 'newuser', 'password': 'Passw0rd12', 'email': 'n@example.com',
        'code': '000000', 'agree': '0'})
    assert r.json()['message'].startswith('请先阅读并同意')


def test_register_success(env):
    _seed_code('new@example.com', '123456')
    r = env.post('/auth/register', json={
        'username': 'newuser', 'password': 'Passw0rd12', 'email': 'new@example.com',
        'code': '123456', 'agree': '1', 'device_id': 'dev-1'})
    assert r.status_code == 200
    body = r.json()
    assert body['success'] is True
    assert '已赠送' in body['message']
    assert 'session' in r.cookies

    # 会话可用
    assert env.post('/auth/heartbeat', json={}).status_code == 200

    # 用户名/邮箱已被占用
    _seed_code('new@example.com', '222222')
    r2 = env.post('/auth/register', json={
        'username': 'newuser', 'password': 'Passw0rd12', 'email': 'new@example.com',
        'code': '222222', 'agree': '1'})
    assert '已被注册' in r2.json()['message']


def test_register_bad_code(env):
    r = env.post('/auth/register', json={
        'username': 'another', 'password': 'Passw0rd12', 'email': 'a@example.com',
        'code': '999999', 'agree': '1'})
    assert r.json()['message'] == '邮箱验证码错误或已过期'


def test_forgot_password_resets(env):
    # 建一个用户
    asyncio.run(auth.create_user('forgetme', 'OldPass123', email='f@example.com', credits=5))
    _seed_code('f@example.com', '654321', purpose='reset')
    r = env.post('/auth/forgot_password', json={
        'email': 'f@example.com', 'code': '654321', 'password': 'NewPass456'})
    assert r.status_code == 200
    assert r.json()['success'] is True
    # 新密码可登录
    r2 = env.post('/auth/login', json={'username': 'forgetme', 'password': 'NewPass456'})
    assert r2.status_code == 200 and r2.json()['success'] is True


def test_forgot_password_admin_blocked(env):
    conn = _connect()
    conn.execute("UPDATE users SET role='admin', email='boss@example.com' WHERE id=1")
    conn.commit()
    conn.close()
    _seed_code('boss@example.com', '111111', purpose='reset')
    r = env.post('/auth/forgot_password', json={
        'email': 'boss@example.com', 'code': '111111', 'password': 'NewPass456'})
    # 管理员不走自助找回：统一防枚举文案
    assert r.json()['message'] == '邮箱验证码错误或已过期'


def test_redeem_card(env):
    # 造一张卡密并让用户登录
    asyncio.run(auth.create_user('buyer', 'Passw0rd12', email='b@example.com', credits=0))
    code = asyncio.run(auth.generate_cards(1, 10, note='test'))[0]
    env.post('/auth/login', json={'username': 'buyer', 'password': 'Passw0rd12'})
    r = env.post('/auth/redeem', json={'code': code})
    assert r.status_code == 200
    assert r.json()['success'] is True
    assert r.json()['data']['credits'] == 10