import json

from src.domain.codegen.port_adapter import catalog_adapter_files


def _contract(password: bool) -> dict:
    return {
        "capabilities": {
            "auth": {
                "methods": ["password"] if password else ["passwordless"],
                "password": password,
            }
        }
    }


def test_passwordless_projection_removes_public_password_routes():
    files = catalog_adapter_files("html", {"runtime_contract": _contract(False)})
    assert "functions/api/auth/forgot-password.js" not in files
    assert "functions/api/auth/reset-password.js" not in files
    assert "functions/_lib/p2hs-auth-password.mjs" in files
    assert "const PASSWORD_ADMITTED = false;" in files["functions/_lib/p2hs-auth-password.mjs"]
    assert "const PASSWORD_ADMITTED = false;" in files["functions/_lib/p2hs-auth-users.mjs"]
    manifest = json.loads(files["p2hs/managed-runtime.json"])
    assert manifest["components"]["auth_password_surface"]["admitted"] is False
    assert not any("forgot-password" in path for path in manifest["components"]["auth_bff"]["paths"])


def test_password_enabled_projection_keeps_password_routes():
    files = catalog_adapter_files("html", {"runtime_contract": _contract(True)})
    assert "functions/api/auth/forgot-password.js" in files
    assert "functions/api/auth/reset-password.js" in files
    assert "const PASSWORD_ADMITTED = true;" in files["functions/_lib/p2hs-auth-password.mjs"]