import pytest

from src.config import Settings
from src.database import build_database_url


@pytest.mark.unit
def test_settings_default_database_url_uses_asyncpg() -> None:
    """Test that default database URL uses asyncpg driver and correct defaults."""
    settings = Settings()
    # When DATABASE_URL env var is set (by conftest), it overrides the defaults
    # This test verifies the URL format when built from defaults
    expected = "postgresql+asyncpg://headquarter:headquarter@localhost:5432/headquarter"
    assert settings.database_url == expected


@pytest.mark.unit

def test_build_database_url_uses_explicit_values() -> None:
    url = build_database_url(
        user="user",
        password="pass",
        host="db",
        port=5433,
        database="app",
    )

    assert url == "postgresql+asyncpg://user:pass@db:5433/app"


@pytest.mark.unit

def test_settings_prefers_explicit_database_url_env(monkeypatch) -> None:
    monkeypatch.setenv("DATABASE_URL", "postgresql+asyncpg://local:local@localhost:5432/localdb")

    settings = Settings()

    assert settings.database_url == "postgresql+asyncpg://local:local@localhost:5432/localdb"


@pytest.mark.unit

def test_auth_settings_have_secure_defaults() -> None:
    settings = Settings()

    assert settings.authentik_client_id == "headquarter-web"
    assert settings.authentik_client_secret == "change-me"
    assert settings.resolved_authentik_authorize_url.endswith("/application/o/authorize/")
    assert settings.resolved_authentik_token_url.endswith("/application/o/token/")
    assert settings.resolved_authentik_jwks_url.endswith("/application/o/headquarter-web/jwks/")
    assert settings.jwt_algorithm == "HS256"
    assert settings.access_token_ttl_minutes == 15
    assert settings.refresh_token_ttl_days == 7


@pytest.mark.unit

def test_cookie_policy_is_strict_in_production(monkeypatch) -> None:
    monkeypatch.setenv("APP_ENV", "production")

    settings = Settings()

    assert settings.cookie_secure is True
    assert settings.cookie_samesite == "strict"


@pytest.mark.unit

def test_cookie_policy_is_relaxed_for_local_dev(monkeypatch) -> None:
    monkeypatch.setenv("APP_ENV", "development")

    settings = Settings()

    assert settings.cookie_secure is False
    assert settings.cookie_samesite == "lax"