"""Tests for Authentication System (core/auth.py)."""

import pytest

from core.auth import AuthManager


@pytest.fixture
def auth_with_key(monkeypatch):
    """Create AuthManager with a known master key."""
    monkeypatch.setenv("MASTER_API_KEY", "test-master-key-12345")
    return AuthManager()


@pytest.fixture
def auth_without_key(monkeypatch):
    """Create AuthManager without env key (auto-generates)."""
    monkeypatch.delenv("MASTER_API_KEY", raising=False)
    return AuthManager()


class TestMasterKeyInit:
    """Test master key initialization."""

    def test_loads_key_from_env(self, auth_with_key):
        """Master key should be loaded from MASTER_API_KEY env var."""
        assert auth_with_key.master_api_key == "test-master-key-12345"

    def test_generates_key_when_missing(self, auth_without_key):
        """Should auto-generate a key when env var is not set."""
        assert auth_without_key.master_api_key is not None
        assert len(auth_without_key.master_api_key) > 20

    def test_generated_keys_are_unique(self, monkeypatch):
        """Each init without env should produce a different key."""
        monkeypatch.delenv("MASTER_API_KEY", raising=False)
        a = AuthManager()
        b = AuthManager()
        assert a.master_api_key != b.master_api_key


class TestMasterKeyValidation:
    """Test master key validation."""

    def test_valid_key_accepted(self, auth_with_key):
        """Correct master key should be accepted."""
        assert auth_with_key.validate_master_key("test-master-key-12345") is True

    def test_invalid_key_rejected(self, auth_with_key):
        """Wrong master key should be rejected."""
        assert auth_with_key.validate_master_key("wrong-key") is False

    def test_empty_key_rejected(self, auth_with_key):
        """Empty string should be rejected."""
        assert auth_with_key.validate_master_key("") is False

    def test_timing_safe_comparison(self, auth_with_key):
        """Validation should use timing-safe comparison (secrets.compare_digest)."""
        # This is a behavioral test: both wrong keys should take similar time
        # We mainly verify the method works correctly for various inputs
        assert auth_with_key.validate_master_key("test-master-key-12345") is True
        assert auth_with_key.validate_master_key("test-master-key-12346") is False

    def test_get_master_key(self, auth_with_key):
        """get_master_key should return the current key."""
        assert auth_with_key.get_master_key() == "test-master-key-12345"


class TestProjectKeys:
    """Test project-specific key management."""

    def test_add_project_key_custom(self, auth_with_key):
        """Should store a custom project key."""
        auth_with_key.add_project_key("proj1", "my-project-key")
        assert auth_with_key.validate_project_key("proj1", "my-project-key") is True

    def test_add_project_key_generated(self, auth_with_key):
        """Should generate a key when none provided."""
        key = auth_with_key.add_project_key("proj1")
        assert key is not None
        assert len(key) > 20
        assert auth_with_key.validate_project_key("proj1", key) is True

    def test_project_key_wrong_project(self, auth_with_key):
        """Project key should not work for a different project."""
        auth_with_key.add_project_key("proj1", "key-for-proj1")
        # proj2 has no key, so it falls back to master key
        assert auth_with_key.validate_project_key("proj2", "key-for-proj1") is False

    def test_fallback_to_master_key(self, auth_with_key):
        """Projects without a specific key should accept master key."""
        assert auth_with_key.validate_project_key("no-key-project", "test-master-key-12345") is True

    def test_remove_project_key(self, auth_with_key):
        """Removing a project key should make it fall back to master."""
        auth_with_key.add_project_key("proj1", "proj-key")
        auth_with_key.remove_project_key("proj1")
        # After removal, should fall back to master key
        assert auth_with_key.validate_project_key("proj1", "proj-key") is False
        assert auth_with_key.validate_project_key("proj1", "test-master-key-12345") is True

    def test_remove_nonexistent_key(self, auth_with_key):
        """Removing a key for a project that has none should not raise."""
        auth_with_key.remove_project_key("nonexistent")  # Should not raise

    def test_has_project_key(self, auth_with_key):
        """has_project_key should reflect current state."""
        assert auth_with_key.has_project_key("proj1") is False
        auth_with_key.add_project_key("proj1", "key")
        assert auth_with_key.has_project_key("proj1") is True
        auth_with_key.remove_project_key("proj1")
        assert auth_with_key.has_project_key("proj1") is False