import tempfile
from pathlib import Path

import pytest

from src.domain.codegen.generated_auth_conformance import (
    assert_generated_auth_conformance,
    check_generated_auth_conformance,
)


def _plan(*, methods=("magic_link",), customer=False, signup=False, reset=False):
    audiences = [
        {
            "audience": "staff",
            "methods": list(methods),
            "signup_allowed": False,
            "password_reset_allowed": reset,
        }
    ]
    if customer:
        audiences.append(
            {
                "audience": "customer",
                "methods": list(methods),
                "signup_allowed": signup,
                "password_reset_allowed": reset,
            }
        )
    return {"runtime": {"authentication_required": True, "auth_contract": {"audiences": audiences}}}


def test_password_ui_is_blocked_when_not_admitted():
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-conformance-", dir=Path.cwd()) as raw:
        root = Path(raw)
        (root / "admin.html").write_text('<form><input type="password"></form>', encoding="utf-8")
        findings = check_generated_auth_conformance(root, _plan())
        assert any(item.rule_id == "AUTH-GEN-001" for item in findings)
        with pytest.raises(ValueError, match="AUTH-GEN-001"):
            assert_generated_auth_conformance(root, _plan())


def test_customer_password_does_not_admit_password_ui_on_staff_surface():
    plan = {
        "runtime": {
            "authentication_required": True,
            "auth_contract": {
                "audiences": [
                    {
                        "audience": "staff",
                        "methods": ["magic_link"],
                        "login_route": "/admin/login",
                        "password_reset_allowed": False,
                    },
                    {
                        "audience": "customer",
                        "methods": ["password"],
                        "login_route": "/login",
                        "password_reset_allowed": True,
                    },
                ]
            },
        }
    }
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-audience-", dir=Path.cwd()) as raw:
        root = Path(raw)
        (root / "pages" / "admin").mkdir(parents=True)
        (root / "pages" / "admin" / "login.vue").write_text(
            '<input type="password"> requestPasswordReset()', encoding="utf-8"
        )
        findings = check_generated_auth_conformance(root, plan)
        assert {item.rule_id for item in findings} >= {"AUTH-GEN-008", "AUTH-GEN-009"}


def test_customer_password_ui_remains_allowed_on_customer_surface():
    plan = {
        "runtime": {
            "authentication_required": True,
            "auth_contract": {
                "audiences": [
                    {"audience": "staff", "methods": ["magic_link"], "login_route": "/admin/login"},
                    {"audience": "customer", "methods": ["password"], "login_route": "/login"},
                ]
            },
        }
    }
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-audience-", dir=Path.cwd()) as raw:
        root = Path(raw)
        (root / "pages").mkdir(parents=True)
        (root / "pages" / "login.vue").write_text('<input type="password">', encoding="utf-8")
        assert check_generated_auth_conformance(root, plan) == []


def test_admitted_magic_link_and_customer_signup_are_allowed():
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-conformance-", dir=Path.cwd()) as raw:
        root = Path(raw)
        (root / "login.html").write_text("requestMagicLink(); signUp();", encoding="utf-8")
        assert check_generated_auth_conformance(root, _plan(customer=True, signup=True)) == []


def test_direct_auth_endpoint_is_blocked():
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-conformance-", dir=Path.cwd()) as raw:
        root = Path(raw)
        (root / "login.js").write_text("fetch('/api/auth/magic-link/request')", encoding="utf-8")
        findings = check_generated_auth_conformance(root, _plan())
        assert any(item.rule_id == "AUTH-GEN-007" for item in findings)


def test_codegen_runner_is_not_scanned_as_generated_app_source():
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-conformance-", dir=Path.cwd()) as raw:
        root = Path(raw)
        (root / "scripts").mkdir()
        (root / "scripts" / "p2hs-codegen-action-runner.mjs").write_text(
            "fetch('/api/auth/magic-link/request'); forgot-password; provider password sign-in",
            encoding="utf-8",
        )
        assert check_generated_auth_conformance(root, _plan()) == []


def test_provider_check_does_not_flag_platform_email_sign_in_copy():
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-conformance-", dir=Path.cwd()) as raw:
        root = Path(raw)
        (root / "MagicLinkForm.jsx").write_text(
            'const [email, setEmail] = useState("");\n'
            'return <button>Email sign-in link</button>;\n',
            encoding="utf-8",
        )
        assert check_generated_auth_conformance(root, _plan()) == []


def test_core_staff_shell_is_not_treated_as_provider_customer_auth():
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-conformance-", dir=Path.cwd()) as raw:
        root = Path(raw)
        target = root / "src" / "components" / "P2hsStaffDashboard.jsx"
        target.parent.mkdir(parents=True)
        target.write_text("requestMagicLink(); signUp();", encoding="utf-8")
        assert check_generated_auth_conformance(root, _plan()) == []


def test_provider_sdk_check_remains_blocked():
    with tempfile.TemporaryDirectory(prefix="p2hs-auth-conformance-", dir=Path.cwd()) as raw:
        root = Path(raw)
        (root / "auth.js").write_text(
            'import { createClient } from "@supabase/supabase-js";\n',
            encoding="utf-8",
        )
        findings = check_generated_auth_conformance(root, _plan())
        assert any(item.rule_id == "AUTH-GEN-005" for item in findings)