"""Anmeldung, Sitzung, CSRF, Sicherheitsköpfe."""

from fastapi.testclient import TestClient

from helpers import PASSWORD


def test_ohne_anmeldung_zur_login_seite(app, people):
    with TestClient(app) as client:
        response = client.get("/workspaces", follow_redirects=False)
    assert response.status_code == 303
    assert response.headers["location"] == "/login?next=/workspaces"


def test_falsches_passwort(app, people):
    with TestClient(app) as client:
        response = client.post("/login", data={"username": "anna", "password": "falsch"})
    assert response.status_code == 401
    assert "falsch" in response.text


def test_unbekannter_nutzer(app, people):
    with TestClient(app) as client:
        response = client.post("/login", data={"username": "niemand", "password": PASSWORD})
    assert response.status_code == 401


def test_demo_anmeldung_abgeschaltet_ohne_passwort(settings, db, people):
    from app.main import create_app
    app = create_app(settings.model_copy(update={"demo_password": ""}))
    with TestClient(app) as client:
        response = client.post("/login", data={"username": "anna", "password": ""})
    assert response.status_code in (401, 422)


def test_anmelden_und_abmelden(browser, people):
    b = browser("anna")
    assert b.get("/workspaces").status_code == 200
    assert b.post("/logout").status_code == 303
    assert b.get("/workspaces", follow_redirects=False).status_code == 303


def test_kein_open_redirect(app, people):
    with TestClient(app) as client:
        response = client.post("/login", data={"username": "anna", "password": PASSWORD,
                                               "next": "//boese.example"}, follow_redirects=False)
    assert response.headers["location"] == "/workspaces"


def test_schreiben_ohne_csrf_abgelehnt(browser, people):
    b = browser("anna")
    response = b.client.post("/workspaces", data={"team_id": people["team_demo"], "name": "X"},
                             follow_redirects=False)
    assert response.status_code == 403


def test_csrf_per_kopfzeile(browser, people):
    b = browser("anna")
    response = b.client.post("/workspaces", data={"team_id": people["team_demo"], "name": "X"},
                             headers={"X-CSRF-Token": b.csrf}, follow_redirects=False)
    assert response.status_code == 303


def test_sicherheitskoepfe(browser, people):
    response = browser("anna").get("/workspaces")
    assert "script-src 'self'" in response.headers["Content-Security-Policy"]
    assert "unsafe-inline" not in response.headers["Content-Security-Policy"]
    assert response.headers["X-Frame-Options"] == "DENY"
    assert response.headers["Cache-Control"] == "no-store"