"""A session the server will not accept must say so as an auth failure.

The client clears the stored token and returns to the login screen on 401. Any
other status leaves the browser holding a token that can never work, stuck on a
page that will not load.
"""

import uuid
from datetime import timedelta

from fastapi.testclient import TestClient

from fluksio.core import security
from fluksio.core.config import settings

PROTECTED = [
    f"{settings.API_V1_STR}/users/me",
    f"{settings.API_V1_STR}/flows/",
]


def token_for(subject: str) -> str:
    return security.create_access_token(subject, timedelta(days=1))


def test_no_token_is_unauthorised(client: TestClient) -> None:
    for path in PROTECTED:
        assert client.get(path).status_code == 401


def test_a_token_we_did_not_sign_is_unauthorised(client: TestClient) -> None:
    headers = {"Authorization": "Bearer not.a.real.token"}
    for path in PROTECTED:
        assert client.get(path, headers=headers).status_code == 401


def test_a_token_for_a_user_who_is_gone_is_unauthorised(
    client: TestClient,
) -> None:
    # Properly signed, but the user it names no longer exists — which is what a
    # browser holds after the database is reset.
    headers = {"Authorization": f"Bearer {token_for(str(uuid.uuid4()))}"}
    for path in PROTECTED:
        response = client.get(path, headers=headers)
        assert response.status_code == 401, path