# users/tests/test_users.py

import pytest
from django.urls import reverse
from rest_framework import status
from rest_framework.test import APIClient
from users.models import User


@pytest.mark.django_db
def test_login_returns_token_and_user_data():
    user = User.objects.create_user(email="user@test.com", name="User", password="pass12345")
    client = APIClient()

    url = reverse("token_obtain_pair")
    response = client.post(url, {"email": user.email, "password": "pass12345"}, format="json")

    assert response.status_code == status.HTTP_200_OK
    assert "access" in response.data
    assert "refresh" in response.data
    assert "user" in response.data
    assert response.data["user"]["email"] == user.email


@pytest.mark.django_db
def test_me_endpoint_returns_current_user():
    user = User.objects.create_user(email="me@test.com", name="Me", password="pass12345")
    client = APIClient()
    client.force_authenticate(user=user)

    url = reverse("user-me")
    response = client.get(url)

    assert response.status_code == status.HTTP_200_OK
    assert response.data["email"] == user.email


@pytest.mark.django_db
def test_update_profile_changes_user_name():
    user = User.objects.create_user(email="me@test.com", name="Old Name", password="pass12345")
    client = APIClient()
    client.force_authenticate(user=user)

    url = reverse("user-update-profile")
    response = client.put(url, {"name": "New Name"}, format="json")

    assert response.status_code == status.HTTP_200_OK
    user.refresh_from_db()
    assert user.name == "New Name"


@pytest.mark.django_db
def test_change_password_success():
    user = User.objects.create_user(email="me@test.com", name="User", password="oldpassword")
    client = APIClient()
    client.force_authenticate(user=user)

    url = reverse("user-change-password")
    response = client.post(
        url,
        {"old_password": "oldpassword", "new_password": "newpassword123"},
        format="json"
    )

    assert response.status_code == status.HTTP_200_OK
    user.refresh_from_db()
    assert user.check_password("newpassword123")


@pytest.mark.django_db
def test_change_password_wrong_old_password():
    user = User.objects.create_user(email="me@test.com", name="User", password="oldpassword")
    client = APIClient()
    client.force_authenticate(user=user)

    url = reverse("user-change-password")
    response = client.post(
        url,
        {"old_password": "wrongpass", "new_password": "newpassword123"},
        format="json"
    )

    assert response.status_code == status.HTTP_400_BAD_REQUEST
    assert "old_password" in response.data


@pytest.mark.django_db
def test_toggle_active_requires_admin():
    user = User.objects.create_user(email="user@test.com", name="User", password="pass12345")
    target = User.objects.create_user(email="target@test.com", name="Target", password="pass12345")
    client = APIClient()
    client.force_authenticate(user=user)

    url = reverse("user-toggle-active", args=[target.id])
    response = client.post(url)

    assert response.status_code == status.HTTP_403_FORBIDDEN


@pytest.mark.django_db
def test_toggle_active_success_by_admin():
    admin = User.objects.create_user(
        email="admin@test.com", name="Admin", password="pass12345", is_staff=True
    )
    target = User.objects.create_user(email="target@test.com", name="Target", password="pass12345")
    client = APIClient()
    client.force_authenticate(user=admin)

    url = reverse("user-toggle-active", args=[target.id])
    response = client.post(url)

    assert response.status_code == status.HTTP_200_OK
    target.refresh_from_db()
    assert target.is_active == response.data["is_active"]