"""mailu — recipe-specific functional test #2 (Phase 2 P3, distinctive: working IMAP mailbox).

Beyond "the row exists in config" (test_mailbox), this proves the provisioned mailbox is a REAL,
usable IMAP account: it authenticates against dovecot over IMAP (port 143, host-published) and can
SELECT its INBOX. That exercises mailu's actual mail-account stack (admin provisioning → dovecot auth
backend), not just the admin DB. notls deploy → plain IMAP on 143. Hard assertion, non-vacuous: wrong
credentials / a non-working account fail the login.
"""

from __future__ import annotations

import imaplib
import os
import sys
import time
import uuid

sys.path.insert(0, os.path.dirname(__file__))
import _mailu  # noqa: E402


def test_created_mailbox_authenticates_over_imap(live_app):
    mail_domain = live_app
    local = "ccci-imap-" + uuid.uuid4().hex[:8]
    password = "CcCi-" + uuid.uuid4().hex[:16] + "-Aa1!"
    _mailu.ensure_domain(live_app, mail_domain)
    email = _mailu.create_user(live_app, local, mail_domain, password)

    # The account may take a moment to be usable by dovecot after admin provisioning; retry login.
    deadline = time.time() + 90
    last_err = None
    while time.time() < deadline:
        try:
            imap = imaplib.IMAP4("127.0.0.1", 143)
            try:
                imap.login(email, password)
                typ, _ = imap.select("INBOX")
                assert typ == "OK", f"IMAP SELECT INBOX returned {typ} for {email}"
                imap.logout()
                return  # authenticated + selected INBOX → working mailbox
            finally:
                try:
                    imap.shutdown()
                except Exception:  # noqa: BLE001
                    pass
        except (imaplib.IMAP4.error, OSError) as e:  # noqa: PERF203
            last_err = e
            time.sleep(5)
    raise AssertionError(f"created mailbox {email} could not authenticate over IMAP:143 — {last_err}")