import importlib
import os
import re
from types import SimpleNamespace
from urllib.parse import parse_qs, urlparse

from fastapi.testclient import TestClient

os.environ.setdefault("SYSTEM", "spaces")
os.environ.setdefault("SPACE_ID", "test/certificate-generator")
os.environ.setdefault("SPACE_HOST", "test-certificate-generator.hf.space")
os.environ.setdefault("OAUTH_CLIENT_ID", "test-client")
os.environ.setdefault("OAUTH_CLIENT_SECRET", "test-secret")
os.environ.setdefault("OAUTH_SCOPES", "openid profile")
os.environ.setdefault("OPENID_PROVIDER_URL", "https://huggingface.co")
os.environ.setdefault("GRADIO_SSR_MODE", "true")

certificate_app = importlib.import_module("app")


def test_oauth_login_clears_stale_session_before_redirecting():
    with TestClient(certificate_app.app) as client:
        response = client.get("/oauth-login", follow_redirects=False)

    assert response.status_code == 303
    assert response.headers["location"] == "/login/huggingface?_target_url=/"
    cookie = response.headers["set-cookie"].lower()
    assert 'session=""' in cookie
    assert "max-age=0" in cookie
    assert "httponly" in cookie
    assert "samesite=none" in cookie
    assert "secure" in cookie


def test_auth_control_uses_sandbox_safe_navigation():
    logged_out = certificate_app.auth_control(None)
    logged_in = certificate_app.auth_control(
        SimpleNamespace(username='person<script>alert("x")</script>')
    )

    assert 'href="/oauth-login"' in logged_out
    assert 'target="_blank"' in logged_out
    assert 'href="/logout?_target_url=/"' in logged_in
    assert 'target="_self"' in logged_in
    assert 'target="_top"' not in logged_out + logged_in
    assert "<script>" not in logged_in
    assert "&lt;script&gt;" in logged_in


def test_nonzero_verdict_participants_are_eligible():
    for username in ["mackenzietechdocs", "sukosmos", "aza33", "threesixnine", "rinabuoy"]:
        rec = certificate_app.eligibility_for(username)
        assert rec is not None
        assert rec["points"] > 0


def test_renamed_hub_account_uses_frozen_namespace_record():
    assert certificate_app.eligibility_for("deepak12kambala") == certificate_app.eligibility_for(
        "deepakkambala"
    )


def test_stats_line_uses_leaderboard_scoring_language():
    assert certificate_app.stats_line({"points": 2, "scored_logbooks": 1}) == (
        "2 leaderboard points across 1 judged logbook"
    )


def test_linkedin_credential_url_is_public_and_personalized():
    linkedin = certificate_app.linkedin_url("Ming Wang", "sci-m-wang")
    params = parse_qs(urlparse(linkedin).query)
    credential_url = params["certUrl"][0]

    assert credential_url.startswith("https://test-certificate-generator.hf.space/verify/")
    assert params["certId"] == ["ICML2026-sci-m-wang"]
    with TestClient(certificate_app.app) as client:
        response = client.get(urlparse(credential_url).path)

    assert response.status_code == 200
    assert "Ming Wang" in response.text
    assert "Publicly verified participation credential" in response.text
    assert "/certificate.png" in response.text


def test_public_credential_rejects_tampering():
    token = certificate_app.credential_token("sci-m-wang", "Ming Wang")
    tampered = ("A" if token[0] != "A" else "B") + token[1:]
    with TestClient(certificate_app.app) as client:
        response = client.get(f"/verify/{tampered}")

    assert response.status_code == 404


def test_root_frontend_asset_is_served():
    """Catch broken asset paths when mounting Gradio at the Space root."""
    with TestClient(certificate_app.app) as client:
        response = client.get("/")
        assert response.status_code == 200

        assets = re.findall(r'(?:src|href)="(\.?/assets/[^"]+)"', response.text)
        assert assets, "root page did not reference a Gradio frontend asset"

        asset_path = assets[0].removeprefix(".")
        asset_response = client.get(asset_path)

    assert asset_response.status_code == 200