"""
Tests for Authentication API Endpoints.

Test Coverage:
- Login endpoint
- Register endpoint
- Profile endpoint
- Logout endpoint
- Token refresh
"""
import pytest
from django.urls import reverse
from rest_framework import status


@pytest.mark.django_db
class TestLoginAPI:
    """Tests for the login endpoint."""

    def test_login_successful(self, api_client, create_user):
        """Test successful login returns tokens and user data."""
        email = 'logintest@example.com'
        password = 'testpass123'
        create_user(email=email, password=password)
        
        response = api_client.post('/api/v1/auth/login/', {
            'email': email,
            'password': password,
        })
        
        assert response.status_code == status.HTTP_200_OK
        assert 'tokens' in response.data
        assert 'access' in response.data['tokens']
        assert 'refresh' in response.data['tokens']
        assert 'user' in response.data
        assert response.data['user']['email'] == email

    def test_login_wrong_password(self, api_client, create_user):
        """Test login with wrong password returns error."""
        email = 'wronglogin@example.com'
        create_user(email=email, password='correctpass123')
        
        response = api_client.post('/api/v1/auth/login/', {
            'email': email,
            'password': 'wrongpass123',
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST

    def test_login_nonexistent_user(self, api_client):
        """Test login with non-existent user returns error."""
        response = api_client.post('/api/v1/auth/login/', {
            'email': 'nonexistent@example.com',
            'password': 'testpass123',
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST

    def test_login_inactive_user(self, api_client, create_user):
        """Test login with inactive user returns error."""
        email = 'inactivelogin@example.com'
        create_user(email=email, password='testpass123', is_active=False)
        
        response = api_client.post('/api/v1/auth/login/', {
            'email': email,
            'password': 'testpass123',
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST

    def test_login_missing_email(self, api_client):
        """Test login without email returns error."""
        response = api_client.post('/api/v1/auth/login/', {
            'password': 'testpass123',
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST

    def test_login_missing_password(self, api_client, create_user):
        """Test login without password returns error."""
        email = 'missingpass@example.com'
        create_user(email=email, password='testpass123')
        
        response = api_client.post('/api/v1/auth/login/', {
            'email': email,
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST


@pytest.mark.django_db
class TestRegisterAPI:
    """Tests for the register endpoint."""

    def test_register_successful(self, api_client):
        """Test successful user registration."""
        response = api_client.post('/api/v1/auth/register/', {
            'email': 'newuser@example.com',
            'password': 'newpass123',
            'password_confirm': 'newpass123',
            'first_name': 'New',
            'last_name': 'User',
        })
        
        assert response.status_code == status.HTTP_201_CREATED
        assert response.data['email'] == 'newuser@example.com'

    def test_register_duplicate_email(self, api_client, create_user):
        """Test registration with existing email returns error."""
        email = 'duplicate@example.com'
        create_user(email=email)
        
        response = api_client.post('/api/v1/auth/register/', {
            'email': email,
            'password': 'testpass123',
            'password_confirm': 'testpass123',
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST
        assert 'email' in response.data

    def test_register_password_mismatch(self, api_client):
        """Test registration with mismatched passwords returns error."""
        response = api_client.post('/api/v1/auth/register/', {
            'email': 'mismatch@example.com',
            'password': 'testpass123',
            'password_confirm': 'differentpass123',
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST

    def test_register_weak_password(self, api_client):
        """Test registration with weak password returns error."""
        response = api_client.post('/api/v1/auth/register/', {
            'email': 'weakpass@example.com',
            'password': '123',
            'password_confirm': '123',
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST

    def test_register_invalid_email(self, api_client):
        """Test registration with invalid email returns error."""
        response = api_client.post('/api/v1/auth/register/', {
            'email': 'invalid-email',
            'password': 'testpass123',
            'password_confirm': 'testpass123',
        })
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST
        assert 'email' in response.data


@pytest.mark.django_db
class TestProfileAPI:
    """Tests for the profile endpoint."""

    def test_get_profile_authenticated(self, authenticated_client):
        """Test authenticated user can get their profile."""
        client, user = authenticated_client
        
        response = client.get('/api/v1/auth/profile/')
        
        assert response.status_code == status.HTTP_200_OK
        profile = response.data.get('data', response.data)
        assert profile['email'] == user.email

    def test_get_profile_unauthenticated(self, api_client):
        """Test unauthenticated user cannot get profile."""
        response = api_client.get('/api/v1/auth/profile/')
        
        assert response.status_code == status.HTTP_401_UNAUTHORIZED

    def test_update_profile(self, authenticated_client):
        """Test authenticated user can update their profile."""
        client, user = authenticated_client
        
        response = client.patch('/api/v1/auth/profile/', {
            'first_name': 'Updated',
            'last_name': 'Name',
        })
        
        assert response.status_code == status.HTTP_200_OK
        profile = response.data.get('data', response.data)
        assert profile['first_name'] == 'Updated'
        assert profile['last_name'] == 'Name'

    def test_update_profile_cannot_change_email(self, authenticated_client):
        """Test user cannot change their email through profile update."""
        client, user = authenticated_client
        original_email = user.email
        
        response = client.patch('/api/v1/auth/profile/', {
            'email': 'newemail@example.com',
        })
        
        # Either returns error or ignores the email change
        if response.status_code == status.HTTP_200_OK:
            profile = response.data.get('data', response.data)
            assert profile['email'] == original_email


@pytest.mark.django_db
class TestLogoutAPI:
    """Tests for the logout endpoint."""

    def test_logout_successful(self, authenticated_client):
        """Test successful logout."""
        client, user = authenticated_client
        
        # First login to get refresh token
        login_response = client.post('/api/v1/auth/login/', {
            'email': user.email,
            'password': 'testpass123',
        }, format='json')
        
        # Skip if login doesn't return tokens in expected format
        if 'tokens' not in login_response.data:
            pytest.skip("Login response format different than expected")
        
        refresh_token = login_response.data['tokens']['refresh']
        
        response = client.post('/api/v1/auth/logout/', {
            'refresh': refresh_token,
        }, format='json')
        
        assert response.status_code == status.HTTP_200_OK

    def test_logout_unauthenticated(self, api_client):
        """Test unauthenticated logout returns error."""
        response = api_client.post('/api/v1/auth/logout/', {})
        
        assert response.status_code == status.HTTP_401_UNAUTHORIZED


@pytest.mark.django_db
class TestTokenRefreshAPI:
    """Tests for the token refresh endpoint."""

    def test_refresh_token_valid(self, api_client, create_user):
        """Test refreshing token with valid refresh token."""
        email = 'refresh@example.com'
        password = 'testpass123'
        create_user(email=email, password=password)
        
        # Login to get tokens
        login_response = api_client.post('/api/v1/auth/login/', {
            'email': email,
            'password': password,
        })
        
        if 'tokens' not in login_response.data:
            pytest.skip("Login response format different than expected")
        
        refresh_token = login_response.data['tokens']['refresh']
        
        # Refresh token - URL is /api/v1/auth/refresh/
        response = api_client.post('/api/v1/auth/refresh/', {
            'refresh': refresh_token,
        })
        
        assert response.status_code == status.HTTP_200_OK
        assert 'access' in response.data

    def test_refresh_token_invalid(self, api_client):
        """Test refreshing with invalid token returns error."""
        response = api_client.post('/api/v1/auth/refresh/', {
            'refresh': 'invalid-token',
        })
        
        assert response.status_code == status.HTTP_401_UNAUTHORIZED

    def test_refresh_token_missing(self, api_client):
        """Test refreshing without token returns error."""
        response = api_client.post('/api/v1/auth/refresh/', {})
        
        assert response.status_code == status.HTTP_400_BAD_REQUEST