# retoor <retoor@molodetz.nl>

import requests
from tests.conftest import BASE_URL


def test_login_session_cookie_missing_secure_flag(seeded_db):
    s = requests.Session()
    r = s.post(
        f"{BASE_URL}/auth/login",
        data={"email": "alice@test.devplace", "password": "secret123"},
        allow_redirects=False,
    )
    set_cookie = r.headers.get("Set-Cookie", "")
    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"