"""Tests for guest authentication — login, logout, tenant isolation.

Security-critical: Guest users must only access their assigned tenant.
Cross-tenant enumeration must be prevented.
"""

from __future__ import annotations

import pytest
from httpx import AsyncClient

from tests.conftest import ORIGIN_HEADER, seed_tenant_and_users, login_client


@pytest.mark.asyncio
class TestGuestAuth:
    """Guest authentication and authorization tests."""

    async def test_guest_login_requires_tenant_slug(self, client: AsyncClient, db_session):
        """Guest login without tenant_slug should return 422 (validation error)."""
        resp = await client.post(
            "/api/v1/guest/login",
            json={"email": "guest@test.de", "password": "TestPass123!"},
            headers=ORIGIN_HEADER,
        )
        # Pydantic validation error — tenant_slug is required
        assert resp.status_code == 422

    async def test_guest_login_invalid_tenant_returns_401(self, client: AsyncClient, db_session):
        """Guest login with non-existent tenant_slug returns 401."""
        resp = await client.post(
            "/api/v1/guest/login",
            json={"email": "guest@test.de", "password": "TestPass123!", "tenant_slug": "nonexistent"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 401

    async def test_guest_login_invalid_credentials(self, client: AsyncClient, db_session):
        """Guest login with valid tenant but wrong password returns 401."""
        # Seed data
        seed = await seed_tenant_and_users(db_session)

        resp = await client.post(
            "/api/v1/guest/login",
            json={"email": "nobody@test.de", "password": "WrongPass!", "tenant_slug": "tenant-a"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 401

    async def test_guest_login_valid_email_format_validation(self, client: AsyncClient, db_session):
        """Guest login with invalid email format returns 422."""
        resp = await client.post(
            "/api/v1/guest/login",
            json={"email": "not-an-email", "password": "TestPass123!", "tenant_slug": "tenant-a"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code == 422

    async def test_guest_login_missing_password(self, client: AsyncClient, db_session):
        """Guest login with empty password returns 401."""
        resp = await client.post(
            "/api/v1/guest/login",
            json={"email": "guest@test.de", "password": "", "tenant_slug": "tenant-a"},
            headers=ORIGIN_HEADER,
        )
        assert resp.status_code in (401, 422)

    async def test_guest_logout_without_session(self, client: AsyncClient, db_session):
        """Guest logout without active session returns 200 (idempotent)."""
        resp = await client.post(
            "/api/v1/guest/logout",
            headers=ORIGIN_HEADER,
        )
        # Guest logout is idempotent — returns 200 even without session
        assert resp.status_code in (200, 401, 403, 400)