# backend/tests/test_auth.py — 로그인/로그아웃/세션/토큰 (AUTH_ENABLED=true)
def _login(c, email="jiwoo@lumi.co", pw="demo-1234"):
    return c.post("/api/auth/login", json={"email": email, "password": pw})


def test_login_sets_cookie_and_returns_me(client_auth):
    r = _login(client_auth)
    assert r.status_code == 200, r.text
    body = r.json()
    assert body["id"] == "jiwoo" and body["initial"] == "지" and body["role"] == "admin"
    assert "ari_session" in r.cookies


def test_protected_route_401_without_session(client_auth):
    assert client_auth.get("/api/tasks").status_code == 401
    assert client_auth.get("/api/me").status_code == 401


def test_wrong_password_same_message(client_auth):
    r = _login(client_auth, pw="nope")
    assert r.status_code == 401
    assert r.json()["detail"] == "이메일 또는 비밀번호가 올바르지 않아요"
    # 존재하지 않는 계정도 동일 메시지(계정 열거 방어)
    r2 = _login(client_auth, email="ghost@x.co")
    assert r2.status_code == 401 and r2.json()["detail"] == "이메일 또는 비밀번호가 올바르지 않아요"


def test_login_then_protected_ok(client_auth):
    _login(client_auth)
    assert client_auth.get("/api/me").status_code == 200
    assert client_auth.get("/api/tasks").status_code == 200


def test_logout_revokes_session(client_auth):
    _login(client_auth)
    assert client_auth.get("/api/me").status_code == 200
    client_auth.post("/api/auth/logout")
    assert client_auth.get("/api/me").status_code == 401


def test_api_token_bearer_auth(client_auth):
    _login(client_auth)
    tok = client_auth.post("/api/me/tokens", params={"name": "스크립트"}).json()
    assert tok["token"] and tok["token"].startswith("ari_")
    client_auth.post("/api/auth/logout")
    # 쿠키 없이 베어러 토큰으로 접근
    r = client_auth.get("/api/me", headers={"Authorization": f"Bearer {tok['token']}"})
    assert r.status_code == 200 and r.json()["id"] == "jiwoo"