import io
import json
import unittest

from user_engine.adapters import InMemoryUserEngineStore, LocalAuthorizationCheckPort
from user_engine.service import UserEngineService
from user_engine.testing.fixtures import FixtureIdentityClaimsAdapter, human_actor_claims
from user_engine.web import PortalApplication


SECRET = "test-proxy-secret-with-adequate-length"


def invoke(app, path, *, method="GET", claims=None, marker=SECRET, body=None):
    payload = json.dumps(body or {}).encode()
    environ = {
        "REQUEST_METHOD": method,
        "PATH_INFO": path,
        "QUERY_STRING": "",
        "CONTENT_LENGTH": str(len(payload)),
        "wsgi.input": io.BytesIO(payload),
        "HTTP_X_REQUEST_ID": "corr_test",
    }
    if claims is not None:
        environ["HTTP_X_VERIFIED_OIDC_CLAIMS"] = json.dumps(claims)
        environ["HTTP_X_USER_ENGINE_PROXY_SECRET"] = marker
    captured = {}

    def start_response(status, headers):
        captured["status"] = status
        captured["headers"] = dict(headers)

    response = b"".join(app(environ, start_response))
    return captured, response


class PortalApplicationTests(unittest.TestCase):
    def setUp(self):
        store = InMemoryUserEngineStore()
        store.migrate()
        service = UserEngineService(
            store=store,
            identity_adapter=FixtureIdentityClaimsAdapter(),
            authorization=LocalAuthorizationCheckPort(),
        )
        self.app = PortalApplication(
            service,
            trusted_proxy_secret=SECRET,
            login_url="https://kc.example/login",
        )
        self.claims = human_actor_claims(tenant="tenant:friendly:binky")

    def test_public_health_and_home(self):
        health, payload = invoke(self.app, "/healthz")
        self.assertEqual("200 OK", health["status"])
        self.assertEqual("no-store", health["headers"]["Cache-Control"])
        self.assertEqual("ok", json.loads(payload)["status"])
        home, html = invoke(self.app, "/")
        self.assertEqual("200 OK", home["status"])
        self.assertIn(b"Sign in with KeyCape", html)

    def test_protected_route_rejects_untrusted_claim_header(self):
        result, payload = invoke(
            self.app, "/api/v1/me", claims=self.claims, marker="attacker"
        )
        self.assertEqual("403 Forbidden", result["status"])
        self.assertNotIn(b"attacker", payload)

    def test_verified_claims_create_current_user(self):
        result, payload = invoke(self.app, "/api/v1/me", claims=self.claims)
        self.assertEqual("200 OK", result["status"])
        decoded = json.loads(payload)
        self.assertEqual("tenant:friendly:binky", decoded["actor"]["tenant"])

    def test_registration_api_is_correlated(self):
        result, payload = invoke(
            self.app,
            "/api/v1/registrations",
            method="POST",
            claims=self.claims,
            body={"tenant": "tenant:friendly:binky"},
        )
        self.assertEqual("201 Created", result["status"])
        self.assertEqual("corr_test", result["headers"]["X-Request-ID"])
        self.assertEqual("factor_pending", json.loads(payload)["status"])


if __name__ == "__main__":
    unittest.main()