from __future__ import annotations

import pytest
from django.core.exceptions import ImproperlyConfigured

from config.settings import _validate_production_security, env_int_range


def test_env_int_range_accepts_default_and_rejects_invalid_values(monkeypatch):
    monkeypatch.delenv("TEST_BOUNDED_SETTING", raising=False)
    assert env_int_range("TEST_BOUNDED_SETTING", 6, minimum=0, maximum=23) == 6

    monkeypatch.setenv("TEST_BOUNDED_SETTING", "24")
    with pytest.raises(ImproperlyConfigured):
        env_int_range("TEST_BOUNDED_SETTING", 6, minimum=0, maximum=23)

    monkeypatch.setenv("TEST_BOUNDED_SETTING", "morgen")
    with pytest.raises(ImproperlyConfigured):
        env_int_range("TEST_BOUNDED_SETTING", 6, minimum=0, maximum=23)


def test_validate_production_security_skips_when_debug_mode_is_enabled():
    _validate_production_security(
        debug=True,
        secret_key="dev-only-change-me",
        allowed_hosts=[],
        csrf_trusted_origins=[],
        session_cookie_secure=False,
        csrf_cookie_secure=False,
        secure_ssl_redirect=False,
    )


@pytest.mark.parametrize(
    (
        "secret_key",
        "allowed_hosts",
        "csrf_trusted_origins",
        "session_cookie_secure",
        "csrf_cookie_secure",
        "secure_ssl_redirect",
    ),
    [
        ("", ["example.org"], ["https://example.org"], True, True, True),
        ("change-me", ["example.org"], ["https://example.org"], True, True, True),
        ("too-short", ["example.org"], ["https://example.org"], True, True, True),
        ("a" * 64, [], ["https://example.org"], True, True, True),
        ("a" * 64, ["*"], ["https://example.org"], True, True, True),
        ("a" * 64, ["example.org"], [], True, True, True),
        ("a" * 64, ["example.org"], ["http://example.org"], True, True, True),
        ("a" * 64, ["example.org"], ["https://example.org"], False, True, True),
        ("a" * 64, ["example.org"], ["https://example.org"], True, False, True),
        ("a" * 64, ["example.org"], ["https://example.org"], True, True, False),
    ],
)
def test_validate_production_security_requires_secure_settings_for_prod(
    secret_key,
    allowed_hosts,
    csrf_trusted_origins,
    session_cookie_secure,
    csrf_cookie_secure,
    secure_ssl_redirect,
):
    with pytest.raises(ImproperlyConfigured):
        _validate_production_security(
            debug=False,
            secret_key=secret_key,
            allowed_hosts=allowed_hosts,
            csrf_trusted_origins=csrf_trusted_origins,
            session_cookie_secure=session_cookie_secure,
            csrf_cookie_secure=csrf_cookie_secure,
            secure_ssl_redirect=secure_ssl_redirect,
        )


def test_validate_production_security_rejects_writable_public_demo():
    with pytest.raises(ImproperlyConfigured):
        _validate_production_security(
            debug=False,
            secret_key="a" * 64,
            allowed_hosts=["vacatureradar.itworx.tech"],
            csrf_trusted_origins=["https://vacatureradar.itworx.tech"],
            session_cookie_secure=True,
            csrf_cookie_secure=True,
            secure_ssl_redirect=True,
            public_base_url="https://vacatureradar.itworx.tech",
            demo_mode_enabled=True,
            demo_read_only=False,
        )


def test_validate_production_security_accepts_read_only_https_demo():
    _validate_production_security(
        debug=False,
        secret_key="a" * 64,
        allowed_hosts=["vacatureradar.itworx.tech"],
        csrf_trusted_origins=["https://vacatureradar.itworx.tech"],
        session_cookie_secure=True,
        csrf_cookie_secure=True,
        secure_ssl_redirect=True,
        public_base_url="https://vacatureradar.itworx.tech",
        demo_mode_enabled=True,
        demo_read_only=True,
    )