"""Régressions des droits admin. Lancer avec : python manage.py test common."""
from django.contrib.auth import get_user_model
from django.test import Client, TestCase
from django.urls import reverse


class AdminApiTests(TestCase):
    def setUp(self):
        User = get_user_model()
        self.superuser = User.objects.create_superuser(username="owner", password="TestPassword2026!")
        self.staff = User.objects.create_user(username="staff", password="TestPassword2026!", is_staff=True)
        self.member = User.objects.create_user(username="member", password="TestPassword2026!")

    def test_dashboard_rejects_anonymous_and_regular_users(self):
        self.assertEqual(self.client.get(reverse("admin-dashboard")).status_code, 401)
        self.client.force_login(self.member)
        self.assertEqual(self.client.get(reverse("admin-dashboard")).status_code, 403)

    def test_staff_can_read_but_not_write(self):
        self.client.force_login(self.staff)
        response = self.client.get(reverse("admin-dashboard"))
        self.assertEqual(response.status_code, 200)
        self.assertEqual(response.json()["stats"]["total"], 3)
        self.assertEqual(self.client.post(reverse("admin-create-user"), data='{"username":"newuser", "password":"AnotherPassword2026!"}', content_type="application/json").status_code, 403)

    def test_superuser_can_create_and_disable_standard_account(self):
        self.client.force_login(self.superuser)
        response = self.client.post(reverse("admin-create-user"), data='{"username":"newuser", "password":"AnotherPassword2026!"}', content_type="application/json")
        self.assertEqual(response.status_code, 201)
        created = get_user_model().objects.get(username="newuser")
        self.assertFalse(created.is_staff)
        response = self.client.post(reverse("admin-user-active", kwargs={"user_id": created.pk}), data='{"is_active":false}', content_type="application/json")
        self.assertEqual(response.status_code, 200)
        created.refresh_from_db()
        self.assertFalse(created.is_active)

    def test_superuser_cannot_disable_self_or_other_superusers(self):
        self.client.force_login(self.superuser)
        response = self.client.post(reverse("admin-user-active", kwargs={"user_id": self.superuser.pk}), data='{"is_active":false}', content_type="application/json")
        self.assertEqual(response.status_code, 403)

    def test_csrf_required_for_login(self):
        client = Client(enforce_csrf_checks=True)
        client.get(reverse("auth-csrf"))
        self.assertEqual(client.post(reverse("auth-login"), data='{"username":"owner", "password":"TestPassword2026!"}', content_type="application/json").status_code, 403)
        token = client.cookies["csrftoken"].value
        response = client.post(reverse("auth-login"), data='{"username":"owner", "password":"TestPassword2026!"}', content_type="application/json", HTTP_X_CSRFTOKEN=token)
        self.assertEqual(response.status_code, 200)
        self.assertEqual(response.json()["user"]["username"], "owner")

    def test_ordinary_user_cannot_log_in_to_admin(self):
        response = self.client.post(reverse("auth-login"), data='{"username":"member", "password":"TestPassword2026!"}', content_type="application/json")
        self.assertEqual(response.status_code, 403)
        self.assertNotIn("_auth_user_id", self.client.session)