from httpx import AsyncClient

from tests.test_me import make_token
from tests.test_sites_crud import Headers, create_site, new_org


async def test_get_site_of_other_org_is_404(client: AsyncClient, auth_headers: Headers) -> None:
    created = await create_site(client, auth_headers(new_org()))
    resp = await client.get(f"/sites/{created['id']}", headers=auth_headers(new_org()))
    assert resp.status_code == 404  # jamais 403 : ne pas révéler l'existence


async def test_patch_site_of_other_org_is_404(client: AsyncClient, auth_headers: Headers) -> None:
    created = await create_site(client, auth_headers(new_org()))
    resp = await client.patch(
        f"/sites/{created['id']}", json={"name": "pirate"}, headers=auth_headers(new_org())
    )
    assert resp.status_code == 404


async def test_delete_site_of_other_org_is_404(client: AsyncClient, auth_headers: Headers) -> None:
    owner = auth_headers(new_org())
    created = await create_site(client, owner)
    resp = await client.delete(f"/sites/{created['id']}", headers=auth_headers(new_org()))
    assert resp.status_code == 404
    assert (await client.get(f"/sites/{created['id']}", headers=owner)).status_code == 200


async def test_target_routes_of_other_org_are_404(
    client: AsyncClient, auth_headers: Headers
) -> None:
    # L'org_id d'une cible dérive toujours du site chargé sous CurrentOrgDep : aucune
    # sous-route cible n'est atteignable depuis une autre organisation (review T2).
    owner = auth_headers(new_org())
    intruder = auth_headers(new_org())
    created = await create_site(client, owner)
    secondary = next(t for t in created["targets"] if not t["is_default"])
    sub = f"/sites/{created['id']}/targets"
    added = await client.post(sub, json={"country": "CH", "language": "fr"}, headers=intruder)
    promoted = await client.patch(
        f"{sub}/{secondary['id']}", json={"is_default": True}, headers=intruder
    )
    removed = await client.delete(f"{sub}/{secondary['id']}", headers=intruder)
    assert [added.status_code, promoted.status_code, removed.status_code] == [404, 404, 404]
    # Le site du propriétaire est intact : rien n'a fuité ni bougé.
    site = (await client.get(f"/sites/{created['id']}", headers=owner)).json()
    assert [t["id"] for t in site["targets"] if t["is_default"]] != [secondary["id"]]
    assert len(site["targets"]) == 2


async def test_list_only_own_org(client: AsyncClient, auth_headers: Headers) -> None:
    await create_site(client, auth_headers(new_org()))
    resp = await client.get("/sites", headers=auth_headers(new_org()))
    assert resp.status_code == 200
    assert resp.json() == {"items": [], "next_cursor": None}


async def test_sites_without_active_org_is_404(client: AsyncClient, test_private_key) -> None:
    token = make_token(test_private_key, org_id=None)
    resp = await client.get("/sites", headers={"Authorization": f"Bearer {token}"})
    assert resp.status_code == 404
    assert resp.json()["detail"] == "Aucune organisation active"