"""Focused regression checks for authentication and proxy hardening."""
import os
import tempfile

tmp_dir = tempfile.mkdtemp(prefix="steelstatista-security-")
os.environ["DB_PATH"] = os.path.join(tmp_dir, "security-test.db")
os.environ["REPORTS_DIR"] = os.path.join(tmp_dir, "reports")
os.environ["SEED_ADMIN"] = "0"
os.environ["COOKIE_SECURE"] = "0"
os.environ["ALLOWED_ORIGINS"] = "http://localhost:5174,https://web.didvan.com"
os.environ["API_TOKEN"] = "didvan-regression-token"

from fastapi.testclient import TestClient
import main
from db import get_conn

client = TestClient(main.app)

for path in (
    "/api/latest",
    "/api/currency",
    "/api/reports",
    "/api/reports/file?folder=x&name=x.pdf",
):
    response = client.get(path)
    assert response.status_code == 401, (path, response.status_code, response.text)

legacy = client.get("/api/sso?t=credential-must-not-be-read", follow_redirects=False)
assert legacy.status_code == 303, legacy.text
assert legacy.headers["location"] == "/login"

partner = client.get(
    "/api/v1/prices/latest",
    headers={"Authorization": "Bearer didvan-regression-token"},
)
assert partner.status_code == 200, partner.text

partner_preflight = client.options(
    "/api/v1/prices/latest",
    headers={
        "Origin": "https://web.didvan.com",
        "Access-Control-Request-Method": "GET",
        "Access-Control-Request-Headers": "authorization",
    },
)
assert partner_preflight.status_code == 200, partner_preflight.text
assert partner_preflight.headers["access-control-allow-origin"] == "https://web.didvan.com"

assert main._resolved_client_ip("203.0.113.8", "1.2.3.4", None) == "203.0.113.8"
assert main._resolved_client_ip("127.0.0.1", "1.2.3.4", None) == "1.2.3.4"

with get_conn() as conn:
    assert not conn.execute("SELECT 1 FROM users WHERE lower(username)='admin'").fetchone()

print("security smoke tests passed")