"""Tests : CMS public, droits, liens et pages libres."""
from django.contrib.auth import get_user_model
from django.test import TestCase
from rest_framework.test import APIClient

from .models import SiteContent, SiteBlock, SitePage


class CMSTests(TestCase):
    def setUp(self):
        User = get_user_model()
        self.admin = User.objects.create_superuser(username='editor', password='StrongPass2026!')
        self.member = User.objects.create_user(username='member', password='StrongPass2026!')
        self.client = APIClient()

    def test_public_content_read_only(self):
        SiteContent.objects.create(key='home.title', value='Bonjour')
        self.assertEqual(self.client.get('/api/cms/content/').data['home.title'], 'Bonjour')
        self.assertEqual(self.client.put('/api/cms/content/home.title/', {'value': 'Non'}, format='json').status_code, 403)
        self.client.force_authenticate(user=self.member)
        self.assertEqual(self.client.put('/api/cms/content/home.title/', {'value': 'Non'}, format='json').status_code, 403)

    def test_admin_can_edit_and_reset(self):
        self.client.force_authenticate(user=self.admin)
        self.assertEqual(self.client.put('/api/cms/content/home.title/', {'value': 'Texte'}, format='json').status_code, 200)
        self.assertEqual(self.client.delete('/api/cms/content/home.title/').status_code, 204)
        self.assertFalse(SiteContent.objects.filter(key='home.title').exists())

    def test_unsafe_links_rejected(self):
        self.client.force_authenticate(user=self.admin)
        self.assertEqual(self.client.put('/api/cms/content/contact.button.href/', {'value': 'javascript:alert(1)'}, format='json').status_code, 400)
        self.assertEqual(self.client.post('/api/cms/blocks/', {'page_slug': 'home', 'kind': 'button', 'url': 'javascript:alert(1)'}, format='json').status_code, 400)

    def test_pages_and_blocks_publication(self):
        page = SitePage.objects.create(slug='cours', title='Cours', published=False)
        SiteBlock.objects.create(page_slug='cours', kind='text', body='Interne', published=False)
        self.assertFalse(self.client.get('/api/cms/pages/').data)
        self.assertFalse(self.client.get('/api/cms/blocks/').data)
        self.client.force_authenticate(user=self.admin)
        self.assertEqual(self.client.get('/api/cms/pages/').data[0]['id'], page.pk)
        self.assertEqual(len(self.client.get('/api/cms/blocks/').data), 1)

    def test_media_upload_is_private(self):
        self.assertEqual(self.client.post('/api/cms/upload/').status_code, 403)