# retoor <retoor@molodetz.nl>

import time
import requests
from tests.conftest import BASE_URL
from devplacepy.database import get_table
JSON_content_negotiation = {"Accept": "application/json"}
_counter_content_negotiation = [0]
def _session_content_negotiation(password="secret123"):
    _counter_content_negotiation[0] += 1
    name = f"cn{int(time.time() * 1000)}{_counter_content_negotiation[0]}"
    s = requests.Session()
    s.post(
        f"{BASE_URL}/auth/signup",
        data={
            "username": name,
            "email": f"{name}@t.dev",
            "password": password,
            "confirm_password": password,
            "birth_date": "1990-01-01",
            "accept_terms": "1",
        },
        allow_redirects=True,
    )
    return s, name
PUBLIC_PAGES = ["/feed", "/projects", "/gists", "/news", "/leaderboard", "/issues"]


def test_admin_pages_negotiate(seeded_db):
    users = get_table("users")
    # unauthenticated: JSON_content_negotiation -> 401, browser -> redirect to login
    assert (
        requests.get(
            f"{BASE_URL}/admin/users", headers=JSON_content_negotiation, allow_redirects=False
        ).status_code
        == 401
    )
    assert (
        requests.get(f"{BASE_URL}/admin/users", allow_redirects=False).status_code
        == 303
    )
    # authenticated non-admin (a fresh member): JSON_content_negotiation -> 403
    _, member = _session_content_negotiation()
    member_key = users.find_one(username=member)["api_key"]
    assert (
        requests.get(
            f"{BASE_URL}/admin/users",
            headers={**JSON_content_negotiation, "X-API-KEY": member_key},
            allow_redirects=False,
        ).status_code
        == 403
    )
    # admin: promote a user whose key has not been cached yet
    admin = _session_content_negotiation()[1]
    admin_row = users.find_one(username=admin)
    users.update({"uid": admin_row["uid"], "role": "Admin"}, ["uid"])
    r = requests.get(
        f"{BASE_URL}/admin/users", headers={**JSON_content_negotiation, "X-API-KEY": admin_row["api_key"]}
    )
    assert r.status_code == 200
    assert "users" in r.json()
    first = r.json()["users"][0]
    assert "password_hash" not in first and "api_key" not in first
