from django.contrib.auth import get_user_model
from django.test import TestCase
from django.urls import reverse

from artifacts.models import ApiKey

User = get_user_model()


class SettingsApiKeysViewTestCase(TestCase):
    def setUp(self):
        self.user = User.objects.create_user(username="alice", password="pw")
        self.client.force_login(self.user)

    def test_requires_login(self):
        self.client.logout()
        response = self.client.get(reverse("settings-api-keys"))
        self.assertEqual(response.status_code, 302)

    def test_create_key(self):
        response = self.client.post(
            reverse("settings-api-keys"), {"action": "create", "name": "hermes-agent"}, follow=True
        )
        self.assertEqual(response.status_code, 200)
        self.assertTrue(ApiKey.objects.filter(user=self.user, name="hermes-agent").exists())

    def test_create_requires_name(self):
        self.client.post(reverse("settings-api-keys"), {"action": "create", "name": "  "})
        self.assertFalse(self.user.api_keys.exists())

    def test_key_value_is_viewable_in_list(self):
        key = ApiKey.objects.create(user=self.user, name="visible")
        response = self.client.get(reverse("settings-api-keys"))
        self.assertContains(response, key.key)  # view-anytime: full key rendered

    def test_revoke_key(self):
        key = ApiKey.objects.create(user=self.user, name="doomed")
        self.client.post(reverse("settings-api-keys"), {"action": "revoke", "key_id": key.pk})
        self.assertFalse(ApiKey.objects.filter(pk=key.pk).exists())

    def test_cannot_revoke_another_users_key(self):
        other = User.objects.create_user(username="bob", password="pw")
        theirs = ApiKey.objects.create(user=other, name="theirs")
        self.client.post(reverse("settings-api-keys"), {"action": "revoke", "key_id": theirs.pk})
        self.assertTrue(ApiKey.objects.filter(pk=theirs.pk).exists())