rar-autopass/tests/test_web_corectie.py

"""Teste US-010 (PRD 3.5): corectie inline pentru randuri ne-trimise blocate.

needs_data corectat valid -> queued cu payload + idempotency actualizate; sent
read-only (403); coliziune de idempotency prinsa pre-UPDATE (fara 500/duplicat);
cross-account interzis (404).
"""

from __future__ import annotations

import json
import os
import re
import tempfile

import pytest
from starlette.testclient import TestClient


def _create_account_user(email: str, name: str = "Service", password: str = "parolasecreta10"):
    from app.accounts import create_account
    from app.users import create_user
    from app.db import get_connection

    conn = get_connection()
    try:
        acct_id = create_account(conn, name, active=True)
        create_user(conn, acct_id, email, password)
        return acct_id
    finally:
        conn.close()


def _login(client, email: str, password: str = "parolasecreta10") -> None:
    resp = client.get("/login")
    m = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text) or \
        re.search(r'value="([^"]+)"\s+name="csrf_token"', resp.text)
    assert m
    resp = client.post("/login", data={"email": email, "parola": password, "csrf_token": m.group(1)})
    assert resp.status_code == 303


def _csrf(client) -> str:
    resp = client.get("/?tab=coada")
    m = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
    assert m
    return m.group(1)


def _insert(acct: int, *, status: str, payload: dict, key: str | None = None) -> int:
    from app.db import get_connection
    conn = get_connection()
    try:
        k = key or f"k-{os.urandom(6).hex()}"
        cur = conn.execute(
            "INSERT INTO submissions (idempotency_key, account_id, status, payload_json) VALUES (?, ?, ?, ?)",
            (k, acct, status, json.dumps(payload)),
        )
        conn.commit()
        return int(cur.lastrowid)
    finally:
        conn.close()


def _row(sid: int):
    from app.db import get_connection
    conn = get_connection()
    try:
        return conn.execute("SELECT * FROM submissions WHERE id=?", (sid,)).fetchone()
    finally:
        conn.close()


def _payload(vin: str, *, odo: str = "55000") -> dict:
    return {
        "vin": vin, "nr_inmatriculare": "B100AAA", "data_prestatie": "2026-06-10",
        "odometru_final": odo, "prestatii": [{"cod_prestatie": "OE-1"}],
    }


@pytest.fixture()
def client(monkeypatch):
    tmp = tempfile.mkdtemp()
    monkeypatch.setenv("AUTOPASS_DB_PATH", os.path.join(tmp, "corectie.db"))
    monkeypatch.setenv("AUTOPASS_WEB_AUTH_REQUIRED", "true")
    from app.config import get_settings
    get_settings.cache_clear()
    from app.web import ratelimit
    ratelimit._hits.clear()
    from app.main import app
    with TestClient(app, follow_redirects=False) as c:
        yield c
    ratelimit._hits.clear()
    get_settings.cache_clear()


def test_corectie_needs_data(client):
    """needs_data fara odometru -> completez odometru -> queued, payload + key actualizate."""
    acct = _create_account_user("cd@test.com")
    # needs_data: odometru gol
    sid = _insert(acct, status="needs_data", payload=_payload("WVWZZZ1JZXW0CD001", odo=""))
    old_key = _row(sid)["idempotency_key"]
    _login(client, "cd@test.com")
    csrf = _csrf(client)

    resp = client.post(f"/trimitere/{sid}/corecteaza", data={
        "odometru_final": "77000", "csrf_token": csrf,
    })
    assert resp.status_code == 200
    r = _row(sid)
    assert r["status"] == "queued"
    assert json.loads(r["payload_json"])["odometru_final"] == "77000"
    assert r["idempotency_key"] != old_key  # recalculata
    assert r["rar_error"] is None


def test_corectie_inca_invalid_ramane_blocat(client):
    """Corectie cu date inca invalide -> ramane needs_data + mesaj de validare."""
    acct = _create_account_user("ci@test.com")
    sid = _insert(acct, status="needs_data", payload=_payload("WVWZZZ1JZXW0CI001", odo=""))
    _login(client, "ci@test.com")
    csrf = _csrf(client)

    # odometru tot invalid (non-numeric)
    resp = client.post(f"/trimitere/{sid}/corecteaza", data={
        "odometru_final": "abc", "csrf_token": csrf,
    })
    assert resp.status_code == 200
    assert _row(sid)["status"] == "needs_data"
    assert "odometruFinal" in resp.text  # mesajul de validare e afisat


def test_corectie_sent_interzis(client):
    """Randurile sent NU pot fi editate (read-only -> 403)."""
    acct = _create_account_user("cs@test.com")
    sid = _insert(acct, status="sent", payload=_payload("WVWZZZ1JZXW0CS001"))
    _login(client, "cs@test.com")
    csrf = _csrf(client)

    resp = client.post(f"/trimitere/{sid}/corecteaza", data={
        "odometru_final": "88000", "csrf_token": csrf,
    })
    assert resp.status_code == 403
    assert _row(sid)["status"] == "sent"  # neschimbat


def test_corectie_coliziune_idempotency(client):
    """Daca noua cheie coincide cu alt submission -> oprire cu mesaj, fara 500/duplicat."""
    from app.idempotency import build_key, canonicalize_row
    acct = _create_account_user("cc@test.com")

    target = _payload("WVWZZZ1JZXW0CC999", odo="99000")
    existing_key = build_key(acct, canonicalize_row(target))
    # B: submission existent cu cheia tinta
    sid_b = _insert(acct, status="queued", payload=target, key=existing_key)
    # A: needs_data, acelasi continut dar fara odometru
    sid_a = _insert(acct, status="needs_data", payload=_payload("WVWZZZ1JZXW0CC999", odo=""))

    _login(client, "cc@test.com")
    csrf = _csrf(client)

    resp = client.post(f"/trimitere/{sid_a}/corecteaza", data={
        "odometru_final": "99000", "csrf_token": csrf,
    })
    assert resp.status_code == 200
    assert "deja o trimitere identica" in resp.text
    assert f"#{sid_b}" in resp.text
    # A NU a fost re-pus in coada (a ramas blocat), B neatins
    assert _row(sid_a)["status"] == "needs_data"
    assert _row(sid_b)["idempotency_key"] == existing_key


def test_corectie_needs_mapping_nu_ajunge_in_coada(client):
    """Un rand needs_mapping cu cod nemapat NU trece in queued la corectie de continut
    (altfel ar pleca la RAR cu codPrestatie null — FINALIZATA ireversibil)."""
    acct = _create_account_user("cm@test.com")
    payload = {
        "vin": "WVWZZZ1JZXW0CM001", "nr_inmatriculare": "B100AAA", "data_prestatie": "2026-06-10",
        "odometru_final": "", "prestatii": [{"cod_op_service": "OP-NEMAP", "denumire": "ceva"}],
    }
    sid = _insert(acct, status="needs_mapping", payload=payload)
    _login(client, "cm@test.com")
    csrf = _csrf(client)

    # completez odometru, dar codul ramane nemapat
    resp = client.post(f"/trimitere/{sid}/corecteaza", data={
        "odometru_final": "70000", "csrf_token": csrf,
    })
    assert resp.status_code == 200
    assert _row(sid)["status"] == "needs_mapping"  # NU queued
    assert "cod RAR" in resp.text.lower() or "mapari" in resp.text.lower()


def test_corectie_cont_strain(client):
    """Corectie pe randul altui cont -> 404 (fara leak)."""
    acct1 = _create_account_user("ca1@test.com", name="C1")
    _create_account_user("ca2@test.com", name="C2")
    sid1 = _insert(acct1, status="needs_data", payload=_payload("WVWZZZ1JZXW0CA001", odo=""))

    _login(client, "ca2@test.com")
    csrf = _csrf(client)
    resp = client.post(f"/trimitere/{sid1}/corecteaza", data={
        "odometru_final": "10000", "csrf_token": csrf,
    })
    assert resp.status_code == 404
    assert _row(sid1)["status"] == "needs_data"  # neatins


# =========================================================================== #
# US-004 (PRD 5.9): detaliu editabil in-place, zero dublare, butoane consolidate #
# =========================================================================== #

def _fragment(client, sid: int) -> str:
    resp = client.get(f"/_fragments/trimitere/{sid}")
    assert resp.status_code == 200
    return resp.text


def test_camp_apare_o_singura_data(client):
    """Zero dublare: fiecare camp editabil apare exact O DATA (input editabil pre-completat),
    fara blocul read-only de grila duplicat deasupra formularului."""
    acct = _create_account_user("u1@test.com")
    sid = _insert(acct, status="needs_data", payload=_payload("WVWZZZ1JZXW0U1001", odo=""))
    _login(client, "u1@test.com")
    html = _fragment(client, sid)

    # Fiecare camp editabil apare exact o data, ca input cu name="...".
    for camp in ("nr_inmatriculare", "vin", "data_prestatie", "odometru_final", "odometru_initial"):
        assert html.count(f'name="{camp}"') == 1, f"{camp} trebuie sa apara o singura data"
    # Nu mai exista eticheta separata „Cod RAR".
    assert "Cod RAR" not in html


def test_nr_si_vin_pe_randuri_separate(client):
    """Nr. inmatriculare pe rand propriu, VIN dedesubt — ambele inputuri latime plina,
    nr. inaintea VIN-ului in markup."""
    acct = _create_account_user("u2@test.com")
    sid = _insert(acct, status="needs_data", payload=_payload("WVWZZZ1JZXW0U2001", odo=""))
    _login(client, "u2@test.com")
    html = _fragment(client, sid)

    poz_nr = html.find('name="nr_inmatriculare"')
    poz_vin = html.find('name="vin"')
    assert poz_nr != -1 and poz_vin != -1
    assert poz_nr < poz_vin  # nr. apare inaintea VIN-ului (rand propriu, VIN dedesubt)


def test_un_singur_buton_primar_per_stare(client):
    """R2: needs_data are UN SINGUR buton primar „Salveaza si retrimite" -> /corecteaza."""
    acct = _create_account_user("u3@test.com")
    sid = _insert(acct, status="needs_data", payload=_payload("WVWZZZ1JZXW0U3001", odo=""))
    _login(client, "u3@test.com")
    html = _fragment(client, sid)

    assert "Salveaza si retrimite" in html
    assert html.count("Salveaza si retrimite") == 1
    assert f"/trimitere/{sid}/corecteaza" in html
    # needs_data NU ofera butonul de re-pune separat (acela e doar pentru error).
    assert "Re-pune in coada" not in html


def test_error_foloseste_repune(client):
    """R2 (fix F7): un rand `error` NU are formular de corectie; primarul „Re-pune in coada"
    posteaza pe /repune (NU /corecteaza, care ar da 403)."""
    acct = _create_account_user("u4@test.com")
    sid = _insert(acct, status="error", payload=_payload("WVWZZZ1JZXW0U4001"))
    _login(client, "u4@test.com")
    html = _fragment(client, sid)

    assert "Re-pune in coada" in html
    assert f"/trimitere/{sid}/repune" in html
    # error nu e editabil -> fara post pe /corecteaza si fara butonul de salvare.
    assert f"/trimitere/{sid}/corecteaza" not in html
    assert "Salveaza si retrimite" not in html


def test_sterge_prezent_si_distinct(client):
    """R11: UN SINGUR Sterge, outline distructiv (var(--err)), pe rand separat, cu hx-confirm
    specific; posteaza pe /sterge."""
    acct = _create_account_user("u5@test.com")
    sid = _insert(acct, status="needs_data", payload=_payload("WVWZZZ1JZXW0U5001", odo=""))
    _login(client, "u5@test.com")
    html = _fragment(client, sid)

    assert f"/trimitere/{sid}/sterge" in html
    assert html.count(f"/trimitere/{sid}/sterge") == 1
    assert "var(--err)" in html  # outline distructiv rosu
    assert f"Stergi definitiv trimiterea #{sid}? Nu se poate anula." in html


def test_corectie_pastreaza_comportament(client):
    """Regresie: retry pur (post pe /corecteaza fara modificari) pe needs_data valid ramane
    idempotent — randul ajunge queued, ca azi (comportament ruta neschimbat)."""
    acct = _create_account_user("u6@test.com")
    # needs_data complet valid (toate campurile prezente) -> retry pur il trece in queued.
    sid = _insert(acct, status="needs_data", payload=_payload("WVWZZZ1JZXW0U6001", odo="55000"))
    _login(client, "u6@test.com")
    csrf = _csrf(client)

    resp = client.post(f"/trimitere/{sid}/corecteaza", data={"csrf_token": csrf})
    assert resp.status_code == 200
    assert _row(sid)["status"] == "queued"
    assert resp.headers.get("HX-Trigger-After-Settle") == "trimiteriChanged, inchideModal"