"""系统设置（SMTP）：只有平台管理员能改，授权码不回显，改完立刻生效。

为什么值得单独测：这是全站唯一一个**跨租户**的写接口。租户隔离测试管不到它，
一旦漏了权限判断，任何登录用户都能改掉全平台发信账号（等于劫持找回密码邮件）。
"""

from __future__ import annotations

from httpx import AsyncClient

from app.config import get_settings
from app.services import mail

from .conftest import login, unwrap

settings = get_settings()

SMTP = {
    "host": "smtp.126.com",
    "port": 465,
    "username": "shufenhf@126.com",
    "password": "CH46ngqQ7Z2XE2eZ",
    "from_name": "达道Task",
    "use_ssl": True,
}


async def _admin(client: AsyncClient) -> dict:
    """白名单里的手机号登录，就是平台管理员。"""
    user = await login(client, phone="13605513683")
    return user


async def test_settings_require_platform_admin(client: AsyncClient, monkeypatch) -> None:
    monkeypatch.setattr(settings, "platform_admin_phones", ["13605513683"])
    outsider = await login(client)

    read = await client.get("/api/v1/settings/smtp", headers=outsider["headers"])
    assert read.json()["code"] == 3004

    write = await client.put("/api/v1/settings/smtp", json=SMTP, headers=outsider["headers"])
    assert write.json()["code"] == 3004


async def test_platform_admin_flag_comes_back_in_me(client: AsyncClient, monkeypatch) -> None:
    monkeypatch.setattr(settings, "platform_admin_phones", ["13605513683"])
    admin = await _admin(client)
    outsider = await login(client)

    me_admin = unwrap(await client.get("/api/v1/auth/me", headers=admin["headers"]))
    me_outsider = unwrap(await client.get("/api/v1/auth/me", headers=outsider["headers"]))
    assert me_admin["user"]["platform_admin"] is True
    assert me_outsider["user"]["platform_admin"] is False


async def test_save_smtp_hides_password_and_persists(client: AsyncClient, monkeypatch) -> None:
    monkeypatch.setattr(settings, "platform_admin_phones", ["13605513683"])
    admin = await _admin(client)

    empty = unwrap(await client.get("/api/v1/settings/smtp", headers=admin["headers"]))
    assert empty["configured"] is False

    saved = unwrap(await client.put("/api/v1/settings/smtp", json=SMTP, headers=admin["headers"]))
    assert saved["configured"] is True
    assert saved["source"] == "db"
    assert saved["host"] == "smtp.126.com"
    assert saved["password_set"] is True
    # 授权码一个字节都不能回给页面
    assert "password" not in saved
    assert "CH46ngqQ7Z2XE2eZ" not in str(saved)

    again = unwrap(await client.get("/api/v1/settings/smtp", headers=admin["headers"]))
    assert again["username"] == "shufenhf@126.com"
    assert again["port"] == 465


async def test_saving_without_password_keeps_old_one(client: AsyncClient, monkeypatch) -> None:
    """授权码留空 = 沿用原来的。否则每次改端口都得重新粘贴一遍授权码。"""
    monkeypatch.setattr(settings, "platform_admin_phones", ["13605513683"])
    admin = await _admin(client)
    await client.put("/api/v1/settings/smtp", json=SMTP, headers=admin["headers"])

    payload = {**SMTP, "port": 587, "use_ssl": False, "password": ""}
    resp = await client.put("/api/v1/settings/smtp", json=payload, headers=admin["headers"])
    saved = unwrap(resp)
    assert saved["port"] == 587
    assert saved["password_set"] is True

    from app.db import SessionFactory

    async with SessionFactory() as session:
        cfg = await mail.load_config(session)
    assert cfg is not None
    assert cfg.password == "CH46ngqQ7Z2XE2eZ"
    assert cfg.port == 587


async def test_test_mail_reports_missing_config(client: AsyncClient, monkeypatch) -> None:
    monkeypatch.setattr(settings, "platform_admin_phones", ["13605513683"])
    admin = await _admin(client)
    resp = await client.post(
        "/api/v1/settings/smtp/test", json={"to": "steven@example.com"}, headers=admin["headers"]
    )
    assert resp.json()["code"] == 2020


async def test_test_mail_actually_sends(client: AsyncClient, monkeypatch) -> None:
    """真发信在这里被替换掉——测的是"取到配置、走对收件人"，不是 SMTP 本身。"""
    monkeypatch.setattr(settings, "platform_admin_phones", ["13605513683"])
    admin = await _admin(client)
    await client.put("/api/v1/settings/smtp", json=SMTP, headers=admin["headers"])

    sent: list[tuple] = []

    def fake_send(cfg, to, subject, text, html):  # noqa: ANN001 - 与真实签名一致
        sent.append((cfg.host, cfg.username, to, subject, text))

    monkeypatch.setattr(mail, "_send_sync", fake_send)

    data = unwrap(
        await client.post(
            "/api/v1/settings/smtp/test",
            json={"to": "steven@example.com"},
            headers=admin["headers"],
        )
    )
    assert data["sent"] is True
    assert data["to"] == "steven@example.com"
    assert sent and sent[0][0] == "smtp.126.com"
    assert sent[0][1] == "shufenhf@126.com"