from __future__ import annotations

from datetime import UTC, datetime, timedelta


async def test_password_hash_and_session_lifecycle(app_modules):
    security = app_modules.load("wbb.admin.security")
    admin_db = app_modules.load("wbb.utils.dbadmin")

    encoded = security.hash_password("qwe0.123456")
    assert encoded.startswith("scrypt$")
    assert security.verify_password("qwe0.123456", encoded)
    assert not security.verify_password("wrong-password", encoded)

    user = await admin_db.ensure_default_admin(username="admin", password_hash=encoded)
    assert user["must_change_password"] is True

    raw_token = security.generate_session_token()
    token_hash = security.hash_token(raw_token)
    await admin_db.create_admin_session(
        username="admin",
        token_hash=token_hash,
        csrf_token="csrf-token",
        expires_at=datetime.now(UTC) + timedelta(hours=1),
        remote_address="127.0.0.1",
        user_agent="pytest",
    )
    session = await admin_db.get_admin_session(token_hash)
    assert session is not None
    assert session["user"]["username"] == "admin"

    await admin_db.update_admin_password("admin", security.hash_password("new-pass-123"))
    assert await admin_db.get_admin_session(token_hash) is None
    updated = await admin_db.get_admin_user("admin")
    assert updated["must_change_password"] is False


def test_new_password_validation(app_modules):
    security = app_modules.load("wbb.admin.security")

    assert security.validate_new_password("short")
    assert security.validate_new_password("onlyletters")
    assert security.validate_new_password("1234567890")
    assert security.validate_new_password("valid-pass-123") == []