"""Tests für SUPER_ADMIN TLS-Status/Renewal – Test-Server hat kein echtes
Zertifikat, daher fällt get_tls_status() auf mode="proxy" zurück. Renewal-
Endpunkte werden nur auf Rollen-Gate + Input-Validierung geprüft (echtes
Skript-Ausführen ist Server-Ops, kein Unit-Test-Ziel)."""
import uuid

import pytest
from httpx import AsyncClient
from sqlalchemy import text

from app.core.security import hash_password
from app.models.user import User, UserRole


async def _make_user(db, *, email, role, company_id=None, password="Secret123"):
    await db.execute(text("SET LOCAL app.bypass_rls = 'on'"))
    user = User(
        id=uuid.uuid4(), company_id=company_id, email=email,
        password_hash=hash_password(password),
        first_name=role.title(), last_name="User",
        role=UserRole(role), is_active=True,
    )
    db.add(user)
    await db.commit()
    return user.id


async def _login(client, email, password="Secret123"):
    r = await client.post("/api/v1/auth/login", json={"email": email, "password": password})
    assert r.status_code == 200, r.text
    return {"Authorization": f"Bearer {r.json()['access_token']}"}


@pytest.mark.asyncio(loop_scope="session")
async def test_tls_status_superadmin_only(client: AsyncClient, db_session):
    await _make_user(db_session, email="sa-tls@platform.de", role="SUPER_ADMIN")
    h = await _login(client, "sa-tls@platform.de")

    r = await client.get("/api/v1/admin/tls/status", headers=h)
    assert r.status_code == 200, r.text
    assert r.json()["mode"] == "proxy"
    assert r.json()["renewable"] is False


@pytest.mark.asyncio(loop_scope="session")
async def test_tls_status_forbidden_for_non_superadmin(client: AsyncClient, db_session):
    company_id = uuid.uuid4()
    from app.models.company import Company
    await db_session.execute(text("SET LOCAL app.bypass_rls = 'on'"))
    db_session.add(Company(id=company_id, name="Acme", slug=f"acme-{company_id.hex[:8]}"))
    await db_session.commit()
    await _make_user(db_session, email="admin-tls@acme.de", role="COMPANY_ADMIN", company_id=company_id)
    h = await _login(client, "admin-tls@acme.de")

    r = await client.get("/api/v1/admin/tls/status", headers=h)
    assert r.status_code == 403


@pytest.mark.asyncio(loop_scope="session")
async def test_tls_renew_certbot_rejects_invalid_domain(client: AsyncClient, db_session):
    await _make_user(db_session, email="sa-tls2@platform.de", role="SUPER_ADMIN")
    h = await _login(client, "sa-tls2@platform.de")

    r = await client.post("/api/v1/admin/tls/renew/certbot", json={"domain": "; rm -rf /"}, headers=h)
    assert r.status_code == 422