"""lasuite-docs — parity port of recipe-maintainer's oidc_login.py (Phase 2 P2).

SOURCE: references/recipe-maintainer/recipe-info/lasuite-docs/tests/oidc_login.py

End-to-end flow (updated for impress v5.4.0, which REMOVED Bearer/JWT auth on the API —
the app now only accepts its own session cookie from the OIDC authorization-code flow):
1. GET `/api/v1.0/users/me/` without auth → asserts the response REDIRECTS to the dep
   keycloak's realm auth endpoint (the recipe is correctly configured to challenge
   unauthenticated callers — wired via install_steps.sh).
2. Obtain an OIDC token from the dep keycloak via password grant, and assert the API
   now REJECTS it as a Bearer credential (the v5.4.0 auth hardening — a 200 here would
   mean the hardening regressed).
3. Log in via the real OIDC authorization-code flow (app → keycloak form → callback →
   session cookie) and call `/api/v1.0/users/me/` with the session → asserts 200 and the
   returned user's email matches the provisioned test user.

Marked @pytest.mark.requires_deps — skips with `deps-not-ready` if dep provisioning failed.
"""

from __future__ import annotations

import os
import ssl
import sys
import urllib.error
import urllib.request

import pytest

sys.path.insert(0, os.path.dirname(__file__))
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
from _oidc_session import OidcSession  # noqa: E402  (recipe-local helper, same dir)
from harness import http as harness_http  # noqa: E402
from harness import sso  # noqa: E402

_CTX = ssl.create_default_context()
_CTX.check_hostname = False
_CTX.verify_mode = ssl.CERT_NONE


class _NoFollow(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        raise urllib.error.HTTPError(newurl, code, msg, headers, fp)


def _get_no_redirect(url: str) -> tuple[int, str]:
    """GET without auto-following redirects. Returns (status, redirect_url-or-body)."""
    opener = urllib.request.build_opener(_NoFollow, urllib.request.HTTPSHandler(context=_CTX))
    try:
        with opener.open(url, timeout=15) as resp:
            return resp.status, resp.read().decode(errors="replace")
    except urllib.error.HTTPError as e:
        if e.code in (301, 302, 303, 307, 308):
            return e.code, e.headers.get("Location", "")
        return e.code, ""


@pytest.mark.requires_deps
def test_oidc_login_via_keycloak(live_app, deps):
    """Anonymous → redirect to keycloak; password-grant token → 200 from /api/v1.0/users/me/."""
    kc = deps["keycloak"]

    # Step 1: unauthenticated GET → 302 to keycloak realm's auth endpoint
    status, redirect = _get_no_redirect(f"https://{live_app}/api/v1.0/users/me/")
    expected_prefix = f"https://{kc['domain']}/realms/{kc['realm']}/protocol/openid-connect/auth"
    # Some configurations return 401 with WWW-Authenticate (an OIDC challenge) rather than a
    # 302 redirect. Both are valid "auth-required" indicators — accept either, but if a
    # redirect is returned it must point at the dep keycloak realm.
    if status in (301, 302, 303, 307, 308):
        assert expected_prefix in (redirect or ""), (
            f"Docs redirected to {redirect!r}, expected to start with {expected_prefix!r}"
        )
    else:
        assert status in (401, 403), (
            f"GET /api/v1.0/users/me/ unauth: HTTP {status}; expected redirect to keycloak "
            f"OR 401/403. (200 would be an auth leak.)"
        )

    # Step 2: obtain an OIDC token via password grant against the dep keycloak, and assert
    # the API REJECTS it as Bearer — impress v5.4.0 removed Bearer/JWT auth (SessionAuthentication
    # only); a 200 here would mean the auth hardening regressed.
    creds = {
        "client_id": kc["client_id"],
        "client_secret": kc["client_secret"],
        "user": kc["user"],
        "password": kc["password"],
        "token_url": kc["token_url"],
    }
    access_token = sso.oidc_password_grant(creds)
    assert isinstance(access_token, str) and access_token.count(".") == 2, "expected JWT"
    status, body = harness_http.http_get(
        f"https://{live_app}/api/v1.0/users/me/",
        headers={"Authorization": f"Bearer {access_token}"},
    )
    assert status in (401, 403), (
        f"GET /api/v1.0/users/me/ with a Bearer JWT returned HTTP {status} — impress >= v5.4.0 "
        f"must reject raw Bearer tokens (got body {body!r})"
    )

    # Step 3: the successor auth path — real OIDC authorization-code login (session cookie);
    # the session-authenticated whoami must return the provisioned user.
    sess = OidcSession(f"https://{live_app}")
    me = sess.login(kc["user"], kc["password"])
    assert me.get("email") == kc["email"], (
        f"unexpected user email: got {me.get('email')!r}, expected {kc['email']!r}"
    )