import time
from io import BytesIO

from fastapi.testclient import TestClient
from PIL import Image

from app import mfa
from app.main import app
from tests.test_v5 import H, user


def login(email, password, code=None):
    c = TestClient(app)
    c.headers.update(H)
    body = {"email": email, "password": password}
    if code is not None:
        body["code"] = code
    return c, c.post("/api/auth/login", json=body)


def now_code(secret, offset=0):
    return mfa.code_at(secret, int(time.time() // mfa.STEP) + offset)


def test_rfc6238_vectors():
    import base64
    s = base64.b32encode(b"12345678901234567890").decode().rstrip("=")
    assert mfa.code_at(s, 59 // 30) == "287082" and mfa.code_at(s, 1111111109 // 30) == "081804"


def test_mfa_set_up_sign_in_recovery_and_reset(client):
    ana = user(client, "ana@t.local", "editor")
    setup = ana.post("/api/auth/mfa/setup").json()
    assert setup["uri"].startswith("otpauth://totp/") and "<svg" in setup["qr_svg"]
    secret = setup["secret"]
    # not on until a code is confirmed
    assert ana.get("/api/auth/me").json()["mfa_enabled"] is False
    assert ana.post("/api/auth/mfa/enable", json={"code": "000000" if now_code(secret) != "000000" else "111111"}).status_code == 400
    r = ana.post("/api/auth/mfa/enable", json={"code": now_code(secret)}).json()
    codes = r["recovery_codes"]
    assert r["user"]["mfa_enabled"] and len(codes) == 8 and r["user"]["mfa_recovery_left"] == 8
    listed = {u["email"]: u["mfa_enabled"] for u in client.get("/api/users").json()}
    assert listed == {"admin@test.local": False, "ana@t.local": True}

    # sign-in now asks for the code; no session without it
    c, res = login("ana@t.local", "password-123")
    assert res.status_code == 200 and res.json() == {"mfa_required": True}
    assert c.get("/api/auth/me").status_code == 401
    _, res = login("ana@t.local", "password-123", "123456" if now_code(secret, 1) != "123456" else "654321")
    assert res.status_code == 401 and res.json()["detail"] == "invalid_mfa_code"
    # the code from the enable step was used already; the next one works once
    c, res = login("ana@t.local", "password-123", now_code(secret, 1))
    assert res.status_code == 200 and res.json()["email"] == "ana@t.local" and c.get("/api/auth/me").status_code == 200
    _, res = login("ana@t.local", "password-123", now_code(secret, 1))
    assert res.status_code == 401  # replay refused
    # a recovery code works once
    c, res = login("ana@t.local", "password-123", codes[0].upper())
    assert res.status_code == 200 and res.json()["mfa_recovery_left"] == 7
    assert login("ana@t.local", "password-123", codes[0])[1].status_code == 401

    # an administrator resets it (lost phone)
    me = c.get("/api/auth/me").json()["id"]
    assert ana.post(f"/api/users/{me}/mfa/reset").status_code == 403
    assert client.post(f"/api/users/{me}/mfa/reset").json()["mfa_enabled"] is False
    assert login("ana@t.local", "password-123")[1].json()["email"] == "ana@t.local"
    acts = {r["action"] for r in client.get("/api/activity?entity=user").json()["rows"]}
    assert {"mfa_enabled", "mfa_failed", "mfa_recovery_used", "mfa_reset"} <= acts


def test_mfa_locks_after_wrong_codes_and_turns_off_with_password_and_code(client):
    ana = user(client, "ana@t.local", "viewer")
    secret = ana.post("/api/auth/mfa/setup").json()["secret"]
    ana.post("/api/auth/mfa/enable", json={"code": now_code(secret)})
    for _ in range(mfa.MAX_FAILED - 1):
        assert login("ana@t.local", "password-123", "999999x")[1].status_code == 401
    assert login("ana@t.local", "password-123", "999999x")[1].status_code == 429
    assert login("ana@t.local", "password-123", now_code(secret, 1))[1].status_code == 429  # locked for a while
    assert ana.post("/api/auth/mfa/disable", json={"password": "wrong", "code": ""}).status_code == 400
    from app.db import SessionLocal
    from app.models import User
    with SessionLocal() as db:
        u = db.query(User).filter_by(email="ana@t.local").one()
        u.mfa_locked_until = None
        db.commit()
    assert ana.post("/api/auth/mfa/disable", json={"password": "password-123", "code": now_code(secret, 1)}).json()["mfa_enabled"] is False


def test_avatar_upload_resize_and_remove(client):
    ana = user(client, "ana@t.local", "viewer")
    buf = BytesIO()
    Image.new("RGB", (900, 600), (200, 30, 30)).save(buf, "PNG")
    assert ana.put("/api/auth/me/avatar", files={"file": ("x.txt", b"not a picture")}).status_code == 400
    me = ana.put("/api/auth/me/avatar", files={"file": ("me.png", buf.getvalue(), "image/png")}).json()
    assert me["avatar_url"].startswith(f"/api/users/{me['id']}/avatar?v=")
    pic = client.get(me["avatar_url"])  # other users see it in lists
    assert pic.status_code == 200 and pic.headers["content-type"] == "image/jpeg"
    assert Image.open(BytesIO(pic.content)).size == (256, 256)
    assert ana.delete("/api/auth/me/avatar").json()["avatar_url"] is None
    assert client.get(f"/api/users/{me['id']}/avatar").status_code == 404


def test_theme_is_saved(client):
    assert client.get("/api/auth/me").json()["theme"] == "system"
    assert client.put("/api/auth/me", json={"theme": "dark"}).json()["theme"] == "dark"
    assert client.put("/api/auth/me", json={"theme": "pink"}).json()["theme"] == "dark"