import importlib
import os
import re
from types import SimpleNamespace

from fastapi.testclient import TestClient

os.environ.setdefault("SYSTEM", "spaces")
os.environ.setdefault("SPACE_ID", "test/certificate-generator")
os.environ.setdefault("SPACE_HOST", "test-certificate-generator.hf.space")
os.environ.setdefault("OAUTH_CLIENT_ID", "test-client")
os.environ.setdefault("OAUTH_CLIENT_SECRET", "test-secret")
os.environ.setdefault("OAUTH_SCOPES", "openid profile")
os.environ.setdefault("OPENID_PROVIDER_URL", "https://huggingface.co")

certificate_app = importlib.import_module("app")


def test_oauth_login_clears_stale_session_before_redirecting():
    with TestClient(certificate_app.app) as client:
        response = client.get("/oauth-login", follow_redirects=False)

    assert response.status_code == 303
    assert response.headers["location"] == "/login/huggingface?_target_url=/"
    cookie = response.headers["set-cookie"].lower()
    assert 'session=""' in cookie
    assert "max-age=0" in cookie
    assert "httponly" in cookie
    assert "samesite=none" in cookie
    assert "secure" in cookie


def test_auth_control_uses_top_level_navigation():
    logged_out = certificate_app.auth_control(None)
    logged_in = certificate_app.auth_control(
        SimpleNamespace(username='person<script>alert("x")</script>')
    )

    assert 'href="/oauth-login"' in logged_out
    assert 'target="_top"' in logged_out
    assert 'href="/logout?_target_url=/"' in logged_in
    assert "<script>" not in logged_in
    assert "&lt;script&gt;" in logged_in


def test_root_frontend_asset_is_served():
    """Catch broken asset paths when mounting Gradio at the Space root."""
    with TestClient(certificate_app.app) as client:
        response = client.get("/")
        assert response.status_code == 200

        assets = re.findall(r'(?:src|href)="(\.?/assets/[^"]+)"', response.text)
        assert assets, "root page did not reference a Gradio frontend asset"

        asset_path = assets[0].removeprefix(".")
        asset_response = client.get(asset_path)

    assert asset_response.status_code == 200