"""Isolated issuer, directory and mailbox journey. No production URL or SMTP."""

import subprocess
from pathlib import Path

import pytest

from coulomb_social.apps.members.models import Member, User
from tests.isolated_issuer import CLIENT_ID, TENANT, IsolatedIssuer

ROOT = Path(__file__).resolve().parents[2]
PASSWORD = "synthetic-reset-secret"


@pytest.mark.usecase("CSOC-UC-009")
@pytest.mark.usecase("CSOC-UC-010")
@pytest.mark.usecase("CSOC-UC-011")
@pytest.mark.browser
@pytest.mark.django_db(transaction=True)
def test_isolated_recovery_registration_and_invitation(tmp_path, settings, request):
    issuer = IsolatedIssuer()
    issuer.start()
    try:
        settings.DEBUG = True
        settings.OIDC_ENABLED = True
        settings.OIDC_ISSUER = issuer.base
        settings.OIDC_DISCOVERY_URL = ""
        settings.OIDC_CLIENT_ID = CLIENT_ID
        settings.OIDC_CLIENT_SECRET = ""
        settings.OIDC_SCOPES = "openid profile email"
        settings.USER_ENGINE_BASE_URL = ""
        settings.USER_ENGINE_PROXY_SECRET = ""
        settings.FLEX_AUTH_BASE_URL = ""
        settings.FORGEJO_BASE_URL = ""
        settings.CONTENT_ROOT = str(tmp_path / "content")
        settings.NETKINGDOM_REGISTRATION_URL = issuer.base + "/register"
        server = request.getfixturevalue("live_server")
        redirect = server.url.rstrip("/") + "/auth/callback/"
        settings.OIDC_REDIRECT_URI = redirect
        issuer.allow_redirect(redirect)
        result = subprocess.run(
            [
                "node",
                str(ROOT / "scripts/test-communication-browser.mjs"),
                str(server),
                issuer.base,
                PASSWORD,
            ],
            cwd=ROOT,
            capture_output=True,
            text=True,
            timeout=120,
        )
        assert result.returncode == 0, result.stdout + result.stderr
        assert PASSWORD not in result.stdout
        recovered = Member.objects.get(subject="member-recovered")
        other = Member.objects.get(subject="member-other")
        assert recovered.pk != other.pk
        assert recovered.user_id != other.user_id
        assert recovered.email == other.email == "member@example.test"
        assert recovered.tenant_id == other.tenant_id == TENANT
        assert {recovered.issuer, other.issuer} == {issuer.base}
        for user in User.objects.all():
            assert not user.has_usable_password()
        assert PASSWORD not in repr(issuer.password_hashes)
        assert any(item["state"] == "consumed" and item["kind"] == "verification"
                   for item in issuer.messages)
        assert sum(item["kind"] == "invitation" for item in issuer.messages) == 2
    finally:
        issuer.stop()