# home/tests/test_tenant_isolation.py

from django.test import TestCase, Client
from wagtail.models import Site, Page

from hospit.tenant.models import TenantProfile
from home.models import ArticlePage


class TenantIsolationAPITest(TestCase):
    def setUp(self):
        self.client = Client()

        # =========================
        # Root page (default)
        # =========================
        self.root = Page.get_first_root_node()

        # =========================
        # Tenant A
        # =========================
        self.site_a_root = Page(
            title="Tenant A Root",
            slug="tenant-a-root"
        )
        self.root.add_child(instance=self.site_a_root)
        self.site_a_root.save_revision().publish()

        self.site_a = Site.objects.create(
            hostname="tenant-a.test",
            root_page=self.site_a_root,
            is_default_site=False
        )

        TenantProfile.objects.create(
            site=self.site_a,
            website="https://tenant-a.test",
            api_key="key-a"
        )

        self.article_a = ArticlePage(
            title="Article A",
            slug="article-a"
        )
        self.site_a_root.add_child(instance=self.article_a)
        self.article_a.save_revision().publish()

        # =========================
        # Tenant B
        # =========================
        self.site_b_root = Page(
            title="Tenant B Root",
            slug="tenant-b-root"
        )
        self.root.add_child(instance=self.site_b_root)
        self.site_b_root.save_revision().publish()

        self.site_b = Site.objects.create(
            hostname="tenant-b.test",
            root_page=self.site_b_root,
            is_default_site=False
        )

        TenantProfile.objects.create(
            site=self.site_b,
            website="https://tenant-b.test",
            api_key="key-b"
        )

        self.article_b = ArticlePage(
            title="Article B",
            slug="article-b"
        )
        self.site_b_root.add_child(instance=self.article_b)
        self.article_b.save_revision().publish()

    # =========================
    # TESTS
    # =========================

    def test_tenant_a_can_access_its_own_articles(self):
        response = self.client.get(
            "/api/articles/",
            HTTP_HOST="tenant-a.test",
            HTTP_X_API_KEY="key-a",
        )
        self.assertEqual(response.status_code, 200)

        slugs = [item["slug"] for item in response.json()["items"]]
        self.assertIn("article-a", slugs)

    def test_tenant_a_cannot_access_tenant_b_articles(self):
        response = self.client.get(
            "/api/articles/",
            HTTP_HOST="tenant-a.test",
            HTTP_X_API_KEY="key-a",
        )
        slugs = [item["slug"] for item in response.json()["items"]]
        self.assertNotIn("article-b", slugs)

    def test_invalid_domain_is_rejected(self):
        response = self.client.get(
            "/api/articles/",
            HTTP_HOST="evil.test",
            HTTP_X_API_KEY="key-a",
        )
        self.assertEqual(response.status_code, 403)

    def test_invalid_api_key_is_rejected(self):
        response = self.client.get(
            "/api/articles/",
            HTTP_HOST="tenant-a.test",
            HTTP_X_API_KEY="wrong-key",
        )
        self.assertEqual(response.status_code, 403)

    def test_valid_domain_and_key_is_allowed(self):
        response = self.client.get(
            "/api/articles/",
            HTTP_HOST="tenant-b.test",
            HTTP_X_API_KEY="key-b",
        )
        self.assertEqual(response.status_code, 200)

        slugs = [item["slug"] for item in response.json()["items"]]
        self.assertIn("article-b", slugs)