"""Tests d'endpoints (curseur SQL simulé via la fixture `cur`)."""
from auth import hash_password, create_access_token


def test_health_ok(client, cur):
    cur._one = (1,)
    r = client.get("/health")
    assert r.status_code == 200
    assert r.json()["api"] == "ok"


def test_categories_requires_auth(client):
    # sans token -> 401
    assert client.get("/categories").status_code == 401


def test_services_returns_list(client, cur, auth_headers):
    cur.description = [("id_service",), ("nom_service",)]
    cur._rows = [(1, "Contrat"), (2, "Fournisseur")]
    r = client.get("/services", headers=auth_headers)
    assert r.status_code == 200
    assert {"id_service": 1, "nom_service": "Contrat"} in r.json()


def test_dashboard_filtres_ne_renvoie_que_les_valeurs_utilisees(client, cur, auth_headers):
    # VUE_CONSO ne contient que Contrat / Fournisseur : les services du
    # référentiel sans monitoring rattaché ne doivent pas remonter.
    cur.description = [("service",), ("categorie",)]
    cur._rows = [
        ("Contrat", "DOM-TOM"),
        ("Contrat", "Tiers-payeurs"),
        ("Fournisseur", "Contreparties"),
    ]
    r = client.get("/dashboard/filtres", headers=auth_headers)
    assert r.status_code == 200
    body = r.json()
    assert body["services"] == ["Contrat", "Fournisseur"]
    assert "Business Intelligence" not in body["services"]
    assert body["categories"] == ["Contreparties", "DOM-TOM", "Tiers-payeurs"]
    assert {"service": "Contrat", "categorie": "DOM-TOM"} in body["combinaisons"]


def test_auth_login_success(client, cur):
    cur._one = (1, "admin", hash_password("Admin2026!"), "Admin", 1)
    r = client.post("/auth/login", data={"username": "admin", "password": "Admin2026!"})
    assert r.status_code == 200
    body = r.json()
    assert body["token_type"] == "bearer"
    assert body["user"]["role"] == "Admin"


def test_auth_login_wrong_password(client, cur):
    cur._one = (1, "admin", hash_password("Admin2026!"), "Admin", 1)
    r = client.post("/auth/login", data={"username": "admin", "password": "WRONG"})
    assert r.status_code == 401


def test_auth_me(client, auth_headers):
    r = client.get("/auth/me", headers=auth_headers)
    assert r.status_code == 200
    assert r.json()["username"] == "admin"


def test_monitoring_unknown_returns_404(client, cur, auth_headers):
    r = client.get("/monitorings/999/details", headers=auth_headers)
    assert r.status_code == 404


def test_admin_forbidden_for_consultant(client):
    token = create_access_token({"sub": "bob", "role": "Consultant", "uid": 2})
    r = client.get("/admin/users", headers={"Authorization": f"Bearer {token}"})
    assert r.status_code == 403