import pytest
import hashlib
from datetime import datetime, timedelta
from bson import ObjectId

from src.auth.security import (
    generate_api_key, 
    hash_api_key, 
    verify_api_key,
    create_access_token,
    verify_token
)
from src.models.api_key import ApiKeyModel
from src.models.user import UserModel
from src.models.team import TeamModel


class TestApiKeySecurity:
    """Test API key generation and validation security"""
    
    def test_generate_api_key(self):
        """Test API key generation produces unique, secure keys"""
        team_id = str(ObjectId())
        user_id = str(ObjectId())
        
        # Generate multiple keys
        key1, hash1 = generate_api_key(team_id, user_id)
        key2, hash2 = generate_api_key(team_id, user_id)
        
        # Keys should be different
        assert key1 != key2
        assert hash1 != hash2
        
        # Keys should be sufficiently long
        assert len(key1) >= 32
        assert len(hash1) >= 32
        
        # Keys should contain team and user info
        assert team_id in key1 or user_id in key1
    
    def test_hash_api_key_consistency(self):
        """Test that hashing the same key produces the same hash"""
        key = "test-api-key-123"
        
        hash1 = hash_api_key(key)
        hash2 = hash_api_key(key)
        
        assert hash1 == hash2
        assert len(hash1) >= 32  # Should be a proper hash length
    
    def test_verify_api_key_valid(self):
        """Test verifying a valid API key"""
        team_id = str(ObjectId())
        user_id = str(ObjectId())
        
        raw_key, key_hash = generate_api_key(team_id, user_id)
        
        # Verification should succeed
        assert verify_api_key(raw_key, key_hash) is True
    
    def test_verify_api_key_invalid(self):
        """Test verifying an invalid API key"""
        team_id = str(ObjectId())
        user_id = str(ObjectId())
        
        raw_key, key_hash = generate_api_key(team_id, user_id)
        
        # Wrong key should fail
        assert verify_api_key("wrong-key", key_hash) is False
        
        # Wrong hash should fail
        assert verify_api_key(raw_key, "wrong-hash") is False
    
    def test_api_key_format(self):
        """Test that generated API keys follow expected format"""
        team_id = str(ObjectId())
        user_id = str(ObjectId())
        
        raw_key, key_hash = generate_api_key(team_id, user_id)
        
        # Key should have expected structure (prefix.hash format)
        assert "." in raw_key
        parts = raw_key.split(".")
        assert len(parts) == 2
        
        # First part should be readable prefix
        prefix = parts[0]
        assert len(prefix) >= 8
        
        # Second part should be hash-like
        hash_part = parts[1]
        assert len(hash_part) >= 32


class TestTokenSecurity:
    """Test JWT token generation and validation"""
    
    def test_create_access_token(self):
        """Test creating access tokens"""
        user_id = str(ObjectId())
        team_id = str(ObjectId())
        
        token = create_access_token(
            data={"user_id": user_id, "team_id": team_id}
        )
        
        assert token is not None
        assert isinstance(token, str)
        assert len(token) > 50  # JWT tokens are typically long
    
    def test_verify_token_valid(self):
        """Test verifying a valid token"""
        user_id = str(ObjectId())
        team_id = str(ObjectId())
        
        token = create_access_token(
            data={"user_id": user_id, "team_id": team_id}
        )
        
        payload = verify_token(token)
        assert payload is not None
        assert payload["user_id"] == user_id
        assert payload["team_id"] == team_id
    
    def test_verify_token_invalid(self):
        """Test verifying an invalid token"""
        # Invalid token should return None
        assert verify_token("invalid-token") is None
        assert verify_token("") is None
        assert verify_token(None) is None
    
    def test_token_expiration(self):
        """Test token expiration handling"""
        user_id = str(ObjectId())
        
        # Create token with very short expiration
        token = create_access_token(
            data={"user_id": user_id},
            expires_delta=timedelta(seconds=-1)  # Already expired
        )
        
        # Should fail verification due to expiration
        payload = verify_token(token)
        assert payload is None


class TestSecurityValidation:
    """Test security validation functions"""
    
    def test_validate_team_access(self):
        """Test team access validation"""
        team_id = ObjectId()
        user_team_id = ObjectId()
        
        # User should have access to their own team
        from src.auth.security import validate_team_access
        assert validate_team_access(str(team_id), str(team_id)) is True
        
        # User should not have access to other teams
        assert validate_team_access(str(user_team_id), str(team_id)) is False
    
    def test_validate_admin_permissions(self):
        """Test admin permission validation"""
        from src.auth.security import validate_admin_permissions
        
        admin_user = UserModel(
            email="admin@test.com",
            name="Admin User",
            team_id=ObjectId(),
            is_admin=True
        )
        
        regular_user = UserModel(
            email="user@test.com", 
            name="Regular User",
            team_id=ObjectId(),
            is_admin=False
        )
        
        assert validate_admin_permissions(admin_user) is True
        assert validate_admin_permissions(regular_user) is False
    
    def test_rate_limiting_validation(self):
        """Test rate limiting for API keys"""
        # This would test rate limiting functionality
        # Implementation depends on the actual rate limiting strategy
        pass
    
    def test_api_key_expiration_check(self):
        """Test API key expiration validation"""
        team_id = ObjectId()
        user_id = ObjectId()
        
        # Create expired API key
        expired_key = ApiKeyModel(
            key_hash="test-hash",
            user_id=user_id,
            team_id=team_id,
            name="Expired Key",
            expiry_date=datetime.utcnow() - timedelta(days=1),
            is_active=True
        )
        
        # Create valid API key
        valid_key = ApiKeyModel(
            key_hash="test-hash-2",
            user_id=user_id,
            team_id=team_id,
            name="Valid Key",
            expiry_date=datetime.utcnow() + timedelta(days=30),
            is_active=True
        )
        
        from src.auth.security import is_api_key_valid
        
        assert is_api_key_valid(expired_key) is False
        assert is_api_key_valid(valid_key) is True
    
    def test_inactive_api_key_check(self):
        """Test inactive API key validation"""
        team_id = ObjectId()
        user_id = ObjectId()
        
        # Create inactive API key
        inactive_key = ApiKeyModel(
            key_hash="test-hash",
            user_id=user_id,
            team_id=team_id,
            name="Inactive Key",
            expiry_date=datetime.utcnow() + timedelta(days=30),
            is_active=False
        )
        
        from src.auth.security import is_api_key_valid
        assert is_api_key_valid(inactive_key) is False


class TestSecurityHeaders:
    """Test security headers and middleware"""
    
    def test_cors_headers(self):
        """Test CORS header configuration"""
        # This would test CORS configuration
        pass
    
    def test_security_headers(self):
        """Test security headers like X-Frame-Options, etc."""
        # This would test security headers
        pass
    
    def test_https_enforcement(self):
        """Test HTTPS enforcement in production"""
        # This would test HTTPS redirect functionality
        pass


class TestPasswordSecurity:
    """Test password hashing and validation if implemented"""
    
    def test_password_hashing(self):
        """Test password hashing functionality"""
        # If password authentication is implemented
        pass
    
    def test_password_validation(self):
        """Test password strength validation"""
        # If password authentication is implemented
        pass