from __future__ import annotations

import pytest
from fastapi import FastAPI
from fastapi.testclient import TestClient

from server.auth.context import get_identity
from server.auth.middleware import AuthenticationMiddleware


def _app() -> FastAPI:
    app = FastAPI()
    app.add_middleware(AuthenticationMiddleware)

    @app.get("/api/private")
    async def private() -> dict:
        return get_identity(required=True).to_dict()

    return app


@pytest.mark.parametrize("disabled_value", ["0", "false", "no", "off"])
@pytest.mark.parametrize("headers", [{}, {"x-aps-client": "desktop", "x-aps-device-id": "desktop-test-device"}])
def test_auth_disabled_bypasses_web_and_desktop_login(monkeypatch, disabled_value, headers):
    monkeypatch.setenv("APS_AUTH_ENABLED", disabled_value)

    def unexpected_provider():
        raise AssertionError("credential provider must not be used when authentication is disabled")

    monkeypatch.setattr("server.auth.middleware.get_auth_provider", unexpected_provider)
    monkeypatch.setattr("server.auth.middleware.get_license_provider", unexpected_provider)

    response = TestClient(_app()).get("/api/private", headers=headers)

    assert response.status_code == 200
    assert response.json() == {
        "user_id": "1",
        "username": "local-admin",
        "fullname": "本地免登录管理员",
        "tenant_uuid": "platform",
        "roles": ["system", "admin", "planner", "approver", "auditor", "scheduler", "desktop"],
        "expires_at": None,
        "auth_kind": "disabled",
        "license_type": None,
        "license_activated_at": None,
        "license_expires_at": None,
        "activation_id": None,
    }