# retoor <retoor@molodetz.nl>

import pytest
import requests
from tests.conftest import BASE_URL
from devplacepy.database import set_setting


@pytest.fixture(scope="module", autouse=True)
def _settings(app_server):
    set_setting("rate_limit_per_minute", "1000000")
    yield


def test_adopt_redirects_to_default(app_server):
    r = requests.get(f"{BASE_URL}/devii/adopt", allow_redirects=False)
    assert r.status_code == 303
    assert r.headers["location"] == "/"


def test_adopt_honours_safe_next(app_server):
    r = requests.get(
        f"{BASE_URL}/devii/adopt", params={"next": "/feed"}, allow_redirects=False
    )
    assert r.status_code == 303
    assert r.headers["location"] == "/feed"


def test_adopt_rejects_external_next(app_server):
    r = requests.get(
        f"{BASE_URL}/devii/adopt",
        params={"next": "https://evil.example.com/x"},
        allow_redirects=False,
    )
    assert r.status_code == 303
    assert not r.headers["location"].startswith("http")


def test_adopt_without_pending_session_sets_no_cookie(app_server):
    r = requests.get(f"{BASE_URL}/devii/adopt", allow_redirects=False)
    assert "session" not in r.cookies
