from pathlib import Path
import tempfile

from src.domain.project_auth.legacy_auth_intent import classify_legacy_auth_intent


def test_dormant_reset_route_does_not_prove_password_intent():
    with tempfile.TemporaryDirectory() as raw:
        path = Path(raw) / "functions/api/auth/reset-password.js"
        path.parent.mkdir(parents=True)
        path.write_text("export async function onRequest() { return 'reset-password'; }")
        result = classify_legacy_auth_intent(raw)
    assert result.method == "PASSWORDLESS"


def test_password_login_surface_preserves_password_auth():
    with tempfile.TemporaryDirectory() as raw:
        path = Path(raw) / "src/Login.jsx"
        path.parent.mkdir(parents=True)
        path.write_text("<input type='password' />; signIn(email, password)")
        result = classify_legacy_auth_intent(raw)
    assert result.method == "PASSWORD"
    assert result.repair_class == "PRESERVE_PASSWORD_AUTH"


def test_username_password_is_blocked_as_a_separate_capability():
    with tempfile.TemporaryDirectory() as raw:
        path = Path(raw) / "src/Login.jsx"
        path.parent.mkdir(parents=True)
        path.write_text("<input name='username' type='password' />; signIn(username, password)")
        result = classify_legacy_auth_intent(raw)
    assert result.method == "USERNAME_PASSWORD_UNSUPPORTED"
    assert result.repair_class == "BLOCK_PROJECT_AUTH_INTENT"