def test_api_requires_key(client):
    assert client.get("/api/accounts").status_code == 401
    r = client.get("/api/accounts", headers={"Authorization": "Bearer test-key"})
    assert r.status_code == 200


def test_login_flow(client):
    r = client.post("/login", data={"username": "admin", "password": "falsch"},
                    follow_redirects=False)
    assert r.status_code == 401
    r = client.post("/login", data={"username": "admin", "password": "geheim"},
                    follow_redirects=False)
    assert r.status_code == 303
    assert client.get("/api/accounts").status_code == 200  # Cookie reicht


def test_logout_flow(client):
    r = client.post("/login", data={"username": "admin", "password": "geheim"},
                    follow_redirects=False)
    assert r.status_code == 303
    assert client.get("/api/accounts").status_code == 200

    r = client.post("/logout", follow_redirects=False)
    assert r.status_code == 303
    assert client.get("/api/accounts").status_code == 401


def test_tampered_session_cookie_rejected(client):
    client.cookies.set("fb_session", "gui.invalid-signature")
    assert client.get("/api/accounts").status_code == 401


def test_current_password_hash_falls_back_to_env_when_no_env_file(client, monkeypatch):
    # `client`-Fixture setzt FB_GUI_PASSWORD_HASH direkt und keine FB_ENV_FILE,
    # der Default-Pfad /data/.env existiert im Testlauf nicht -> Fallback.
    from app.auth import current_password_hash
    from app.config import get_settings
    assert current_password_hash() == get_settings().gui_password_hash


def test_current_password_hash_reads_from_env_file_when_present(
    client_with_env_file,
):
    from app.auth import current_password_hash, verify_password
    _client, password = client_with_env_file
    assert verify_password(password, current_password_hash())


def test_current_password_hash_cache_invalidates_on_file_change(
    client_with_env_file, env_file,
):
    from app.auth import current_password_hash, hash_password, verify_password
    path, password = env_file
    first = current_password_hash()
    assert verify_password(password, first)

    new_hash = hash_password("andereswort999")
    path.write_text(f"FB_PASSWORD='andereswort999'\nFB_GUI_PASSWORD_HASH='{new_hash}'\n")

    second = current_password_hash()
    assert second == new_hash
    assert verify_password("andereswort999", second)