import importlib
import time

import jwt
from fastapi import FastAPI
from fastapi.testclient import TestClient


def _client(monkeypatch, jwt_secret="test-jwt-secret-with-at-least-32-bytes", tlsync_secret="test-tlsync-secret"):
    monkeypatch.setenv("JWT_SECRET", jwt_secret)
    if tlsync_secret is None:
        monkeypatch.delenv("TLSYNC_SECRET", raising=False)
    else:
        monkeypatch.setenv("TLSYNC_SECRET", tlsync_secret)

    tlsync = importlib.import_module("routers.tlsync")
    app = FastAPI()
    app.include_router(tlsync.router, prefix="/tlsync")
    return TestClient(app), jwt_secret


def _token(jwt_secret: str) -> str:
    now = int(time.time())
    return jwt.encode(
        {
            "sub": "user-123",
            "aud": "authenticated",
            "iat": now,
            "exp": now + 3600,
        },
        jwt_secret,
        algorithm="HS256",
    )


def test_tlsync_token_requires_bearer_auth(monkeypatch):
    client, _ = _client(monkeypatch)

    response = client.get("/tlsync/token")

    assert response.status_code == 401


def test_tlsync_token_returns_configured_secret(monkeypatch):
    client, jwt_secret = _client(monkeypatch, tlsync_secret="runtime-secret")

    response = client.get(
        "/tlsync/token",
        headers={"Authorization": f"Bearer {_token(jwt_secret)}"},
    )

    assert response.status_code == 200
    assert response.json() == {"token": "runtime-secret"}


def test_tlsync_token_500_when_secret_missing(monkeypatch):
    client, jwt_secret = _client(monkeypatch, tlsync_secret=None)

    response = client.get(
        "/tlsync/token",
        headers={"Authorization": f"Bearer {_token(jwt_secret)}"},
    )

    assert response.status_code == 500