from app.api.routers import auth as auth_router
from app.core.db import SessionLocal
from app.core.security import hash_password
from app.models.user import User


def test_password_login_is_available_only_outside_demo_mode(ops_client, monkeypatch):
    user = User(
        public_ref="USR-REAL",
        email="manager@example.test",
        password_hash=hash_password("correct-horse-battery-staple"),
        display_name="Real Manager",
        role="operations_manager",
        active=True,
    )
    with SessionLocal() as db:
        db.add(user)
        db.commit()
    monkeypatch.setattr(auth_router.settings, "mobilityops_demo_mode", False)

    response = ops_client.post(
        "/api/v1/auth/login",
        json={"email": "manager@example.test", "password": "correct-horse-battery-staple"},
    )
    assert response.status_code == 200
    assert response.json()["public_ref"] == "USR-REAL"
    assert ops_client.get("/api/v1/auth/session").json()["display_name"] == "Real Manager"


def test_password_login_rejects_invalid_credentials(ops_client, monkeypatch):
    monkeypatch.setattr(auth_router.settings, "mobilityops_demo_mode", False)
    response = ops_client.post(
        "/api/v1/auth/login",
        json={"email": "unknown@example.test", "password": "correct-horse-battery-staple"},
    )
    assert response.status_code == 401