"""Auth routes on the fully wired application.

The integration suite's app is built from the indexed test environment
(one provider named ``default``); these tests pin the public surface the
SPA and bookmarks rely on.
"""
from __future__ import annotations

import unittest

from httpx import ASGITransport, AsyncClient

from tavolo.app import app, oidc
from tests.helpers import async_test


class AuthRoutesTest(unittest.TestCase):
    @async_test
    async def test_providers_endpoint_reports_the_configured_provider(self) -> None:
        transport = ASGITransport(app=app)
        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
            response = await client.get("/api/auth/providers")
        self.assertEqual(200, response.status_code)
        self.assertEqual(
            {"providers": [{"name": "default", "login_url": "/auth/default/login"}]},
            response.json(),
        )

    @async_test
    async def test_generic_login_redirects_to_the_provider(self) -> None:
        transport = ASGITransport(app=app)
        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
            response = await client.get("/auth/login", follow_redirects=False)
        self.assertEqual(302, response.status_code)
        self.assertEqual("/auth/default/login", response.headers["location"])

    def test_authorization_scopes_exclude_email(self) -> None:
        # Only the scopes the app uses are requested: openid (sub) and
        # profile (preferred_username/name). kaya-oidc's default would also
        # request email, which the app neither needs nor stores.
        mixin = oidc.provider("default")
        self.assertEqual(("openid", "profile"), tuple(mixin._config.scopes))