from fastapi.testclient import TestClient
from sqlmodel import Session, select

from app.db.session import engine, init_db
from app.main import app
from app.models import AdminCredential


def test_admin_routes_require_login():
    init_db()
    with TestClient(app) as client:
        response = client.get("/api/admin/redemptions")
    assert response.status_code == 401
    assert response.json()["detail"]["code"] == "admin_login_required"


def test_correct_pin_opens_admin_and_logout_revokes_session():
    init_db()
    with TestClient(app) as client:
        login = client.post("/api/admin/auth/login", json={"pin": "9999"})
        token = login.json()["token"]
        me = client.get("/api/admin/auth/me", headers={"X-Admin-Session": token})
        logout = client.post("/api/admin/auth/logout", headers={"X-Admin-Session": token})
        after_logout = client.get("/api/admin/auth/me", headers={"X-Admin-Session": token})

    assert login.status_code == 200
    assert token
    assert me.status_code == 200
    assert me.json()["authenticated"] is True
    assert logout.status_code == 200
    assert after_logout.status_code == 401


def test_wrong_pin_is_rejected_and_pin_is_hashed():
    init_db()
    with TestClient(app) as client:
        response = client.post("/api/admin/auth/login", json={"pin": "0000"})
    with Session(engine) as session:
        credential = session.exec(select(AdminCredential).where(AdminCredential.username == "admin")).first()

    assert response.status_code == 401
    assert credential.pin_hash != "9999"
    assert credential.pin_hash.startswith("pbkdf2_sha256$")