# (c) cavaliba.com - tests / admin account password sync


from django.contrib.auth import get_user_model
from django.test import TestCase, override_settings

from app_home.migrator import sync_admin_password


class AdminPasswordSyncTest(TestCase):
    """cavaliba_start() does not create the Django "admin" superuser (that's done
    by `manage.py createsuperuser` in start_dev.sh / docker-entrypoint.sh), so
    each test creates it by hand and removes it in tearDown to keep tests
    isolated regardless of run order."""

    def setUp(self):
        UserModel = get_user_model()
        self.admin = UserModel.objects.create_user(username="admin", password="initialpassword")

    def tearDown(self):
        get_user_model().objects.filter(username="admin").delete()

    @override_settings(CAVALIBA_ADMIN_PASSWORD="somesecret123")
    def test_sets_password_when_different(self):
        sync_admin_password()
        self.admin.refresh_from_db()
        self.assertTrue(self.admin.check_password("somesecret123"))
        self.assertTrue(self.admin.is_active)

    @override_settings(CAVALIBA_ADMIN_PASSWORD="initialpassword")
    def test_noop_when_password_already_matches(self):
        sync_admin_password()
        self.admin.refresh_from_db()
        self.assertTrue(self.admin.check_password("initialpassword"))

    @override_settings(CAVALIBA_ADMIN_PASSWORD=None)
    def test_locks_account_when_env_var_unset(self):
        sync_admin_password()
        self.admin.refresh_from_db()
        self.assertFalse(self.admin.is_active)
        # password untouched
        self.assertTrue(self.admin.check_password("initialpassword"))

    @override_settings(CAVALIBA_ADMIN_PASSWORD="somesecret123")
    def test_reactivates_locked_account(self):
        self.admin.is_active = False
        self.admin.save()

        sync_admin_password()

        self.admin.refresh_from_db()
        self.assertTrue(self.admin.is_active)
        self.assertTrue(self.admin.check_password("somesecret123"))

    @override_settings(CAVALIBA_ADMIN_PASSWORD="somesecret123")
    def test_noop_when_admin_missing(self):
        get_user_model().objects.filter(username="admin").delete()
        sync_admin_password()
        self.assertFalse(get_user_model().objects.filter(username="admin").exists())