"""keycloak — install stage (recipe #2, DB-backed SSO; D2 install + D3 Playwright)."""

import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
from harness import lifecycle  # noqa: E402


def test_realm_endpoint_healthy(deployed_app):
    """The master realm endpoint answers 200 over HTTPS (keycloak + mariadb are up)."""
    assert lifecycle.http_get(deployed_app, "/realms/master") == 200


def test_playwright_admin_login(deployed_app):
    """A real browser loads the keycloak admin console (renders the sign-in UI)."""
    from playwright.sync_api import sync_playwright

    url = f"https://{deployed_app}/admin/master/console/"
    with sync_playwright() as p:
        browser = p.chromium.launch(args=["--no-sandbox"])
        try:
            page = browser.new_context(ignore_https_errors=True).new_page()
            page.goto(url, wait_until="domcontentloaded", timeout=45000)
            # admin console redirects to the login form; wait for a username field to render
            page.wait_for_selector("input#username, input[name='username']", timeout=30000)
            assert (
                "keycloak" in page.content().lower() or page.locator("input#username").count() > 0
            )
        finally:
            browser.close()