"""인증 API — 프론트 auth.api.ts / types/api.ts 계약."""

TOKEN_KEYS = {
    "token",
    "tokenExpirationTime",
    "refreshToken",
    "refreshTokenExpirationTime",
    "tokenType",
    "user",
}
USER_KEYS = {"id", "email", "userName", "role", "employeeId", "department", "authProvider"}


def test_login_returns_token_response(api, user):
    res = api.post("/api/v1/auth/login", {"email": "U@X.com", "password": "pw1234"}, format="json")
    assert res.status_code == 200
    data = res.json()["data"]
    assert set(data) == TOKEN_KEYS
    assert data["tokenType"] == "bearer"
    assert set(data["user"]) == USER_KEYS
    assert data["user"]["email"] == "u@x.com"
    assert data["user"]["role"] == "USER"
    assert data["user"]["authProvider"] == "local"
    assert data["tokenExpirationTime"] < data["refreshTokenExpirationTime"]


def test_login_wrong_password_401_with_code(api, user):
    res = api.post("/api/v1/auth/login", {"email": "u@x.com", "password": "nope"}, format="json")
    assert res.status_code == 401
    assert res.json()["code"] == "INVALID_CREDENTIALS"


def test_me_with_bearer(auth_api):
    res = auth_api.get("/api/v1/users/me")
    assert res.status_code == 200
    data = res.json()["data"]
    assert data["email"] == "u@x.com"
    assert data["isActive"] is True
    assert "createdAt" in data


def test_me_with_query_token(api, auth_api):
    # EventSource 등 헤더 못 붙이는 곳용
    plain = api.__class__()
    res = plain.get(f"/api/v1/users/me?token={auth_api.tokens['token']}")
    assert res.status_code == 200


def test_refresh_issues_new_access(auth_api):
    old = auth_api.tokens
    res = auth_api.post("/api/v1/auth/refresh", {"refreshToken": old["refreshToken"]}, format="json")
    assert res.status_code == 200
    data = res.json()["data"]
    assert set(data) == TOKEN_KEYS
    assert data["refreshToken"] == old["refreshToken"]  # 회전 안 함
    assert data["user"]["email"] == "u@x.com"


def test_refresh_missing_token(api, db):
    res = api.post("/api/v1/auth/refresh", {}, format="json")
    assert res.status_code == 401
    assert res.json()["code"] == "REFRESH_TOKEN_MISSING"


def test_refresh_bad_token(api, db):
    res = api.post("/api/v1/auth/refresh", {"refreshToken": "garbage"}, format="json")
    assert res.status_code == 401
    assert res.json()["code"] == "REFRESH_TOKEN_INVALID"


def test_logout_is_public_and_null(api, db):
    res = api.post("/api/v1/auth/logout", format="json")
    assert res.status_code == 200
    assert res.json()["data"] is None


def test_entra_config_is_501(api, db):
    res = api.get("/api/v1/auth/entra/config")
    assert res.status_code == 501
    assert res.json()["code"] == "NOT_IMPLEMENTED"


def test_seed_users_exist_after_migrate(db):
    from apps.accounts.models import User

    assert User.objects.filter(email="admin@codeassist.local", is_superuser=True).exists()
    assert User.objects.filter(email="guest@codeassist.local").exists()