from src.domain.project_auth.auth_contract import canonical_auth_target, legacy_auth_projection


def test_email_and_magic_link_are_historical_passwordless_only():
    projection = legacy_auth_projection(["email", "magic_link"])

    assert projection["auth_methods"] == ["passwordless"]
    assert projection["identity_channels"] == ["email"]
    assert projection["connections"] == [
        {"id": "local_magic_link", "method": "passwordless", "channel": "email"}
    ]


def test_password_is_not_inferred_from_email_or_magic_link():
    assert "password" not in legacy_auth_projection(["email"])["auth_methods"]
    assert "password" not in legacy_auth_projection(["magic_link"])["auth_methods"]


def test_explicit_password_provider_is_preserved_alongside_passwordless():
    projection = legacy_auth_projection(["password", "email", "magic_link"])

    assert projection["auth_methods"] == ["password", "passwordless"]


def test_google_legacy_provider_maps_to_oidc():
    projection = legacy_auth_projection(["google"])

    assert projection["auth_methods"] == ["oidc"]
    assert projection["identity_channels"] == ["oidc"]


def test_canonical_target_materializes_legacy_passwordless_contract():
    target = canonical_auth_target(
        providers=["email", "magic_link"],
        auth_methods=[],
        audiences=["staff", "customer"],
        allow_signup=True,
        admin_route="/admin",
        customer_route="/login",
    )

    assert target["staff"] == {
        "enabled": True,
        "methods": ["passwordless"],
        "signup": False,
        "password_reset": False,
    }
    assert target["customer"]["methods"] == ["passwordless"]
    assert target["customer"]["signup"] is True
    assert target["customer"]["password_reset"] is False
    assert target["session_target"] == "httponly_cookie"