rar-autopass/tests/test_web_auto_send.py

"""Strat web: toggle "Trimite automat la RAR", trimitere manuala per rand + bulk,
afisaj held, banner coada tinuta imbatranita + contor manual, audit app_events.

Model: TestClient + login web (ca tests/test_web_lifecycle.py). NU atinge conftest.
"""

from __future__ import annotations

import json
import os
import re
import tempfile

import pytest
from starlette.testclient import TestClient


@pytest.fixture()
def client(monkeypatch):
    tmp = tempfile.mkdtemp()
    monkeypatch.setenv("AUTOPASS_DB_PATH", os.path.join(tmp, "as.db"))
    monkeypatch.setenv("AUTOPASS_LOG_DIR", os.path.join(tmp, "logs"))
    monkeypatch.setenv("AUTOPASS_WEB_AUTH_REQUIRED", "true")
    from app.config import get_settings
    get_settings.cache_clear()
    from app.web import ratelimit
    ratelimit._hits.clear()
    from app.main import app
    with TestClient(app, follow_redirects=False) as c:
        yield c
    ratelimit._hits.clear()
    get_settings.cache_clear()


def _account_user(email, name="Service", password="parolasecreta10"):
    from app.accounts import create_account
    from app.users import create_user
    from app.db import get_connection
    conn = get_connection()
    try:
        aid = create_account(conn, name, active=True)
        create_user(conn, aid, email, password)
        return aid
    finally:
        conn.close()


def _login(client, email, password="parolasecreta10"):
    resp = client.get("/login")
    m = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text) or \
        re.search(r'value="([^"]+)"\s+name="csrf_token"', resp.text)
    resp = client.post("/login", data={"email": email, "parola": password, "csrf_token": m.group(1)})
    assert resp.status_code == 303, resp.text[:200]
    return _csrf(client)


def _csrf(client):
    resp = client.get("/?tab=acasa")
    m = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
    assert m, "csrf_token negasit dupa login"
    return m.group(1)


def _ins(account_id, status="queued", held=0, created_at=None):
    from app.db import get_connection
    conn = get_connection()
    try:
        content = {"vin": "WVWZZZ1KZAW000123", "nr_inmatriculare": "B999TST",
                   "data_prestatie": "2026-06-15", "odometru_final": "123456",
                   "prestatii": [{"cod_prestatie": "OE-1"}]}
        if created_at is None:
            cur = conn.execute(
                "INSERT INTO submissions (idempotency_key, account_id, status, payload_json, held) "
                "VALUES (?, ?, ?, ?, ?)",
                (f"k-{os.urandom(6).hex()}", account_id, status, json.dumps(content), held),
            )
        else:
            cur = conn.execute(
                "INSERT INTO submissions (idempotency_key, account_id, status, payload_json, held, created_at) "
                "VALUES (?, ?, ?, ?, ?, ?)",
                (f"k-{os.urandom(6).hex()}", account_id, status, json.dumps(content), held, created_at),
            )
        conn.commit()
        return int(cur.lastrowid)
    finally:
        conn.close()


def _get_auto_send(account_id):
    from app.db import get_connection
    conn = get_connection()
    try:
        r = conn.execute("SELECT auto_send_enabled FROM accounts WHERE id=?", (account_id,)).fetchone()
        return int(r["auto_send_enabled"])
    finally:
        conn.close()


def _held(sid):
    from app.db import get_connection
    conn = get_connection()
    try:
        return int(conn.execute("SELECT held FROM submissions WHERE id=?", (sid,)).fetchone()["held"])
    finally:
        conn.close()


# --------------------------------------------------------------------------- #
# Toggle Auto: persistenta + CSRF + scope                                     #
# --------------------------------------------------------------------------- #

def test_auto_send_persista(client):
    aid = _account_user("a1@test.com")
    csrf = _login(client, "a1@test.com")
    assert _get_auto_send(aid) == 0
    r = client.post("/auto-send", data={"enabled": "1", "csrf_token": csrf})
    assert r.status_code == 200
    assert _get_auto_send(aid) == 1
    # Debifare
    r = client.post("/auto-send", data={"csrf_token": csrf})  # enabled absent = OFF
    assert r.status_code == 200
    assert _get_auto_send(aid) == 0


def test_auto_send_csrf(client):
    aid = _account_user("a2@test.com")
    _login(client, "a2@test.com")
    r = client.post("/auto-send", data={"enabled": "1", "csrf_token": "gresit"})
    assert r.status_code == 403
    assert _get_auto_send(aid) == 0


def test_auto_send_scoped_nu_atinge_alt_cont(client):
    aid = _account_user("a3@test.com", name="A3")
    other = _account_user("a3b@test.com", name="A3B")
    csrf = _login(client, "a3@test.com")
    r = client.post("/auto-send", data={"enabled": "1", "csrf_token": csrf})
    assert r.status_code == 200
    assert _get_auto_send(aid) == 1
    # contul celalalt ramane OFF (account_id vine din sesiune, nu din formular)
    assert _get_auto_send(other) == 0


def test_auto_send_scoped_ignora_account_id_din_formular(client):
    aid = _account_user("a4@test.com", name="A4")
    other = _account_user("a4b@test.com", name="A4B")
    csrf = _login(client, "a4@test.com")
    # incearca sa forteze alt cont prin formular -> trebuie ignorat
    r = client.post("/auto-send", data={"enabled": "1", "account_id": str(other), "csrf_token": csrf})
    assert r.status_code == 200
    assert _get_auto_send(aid) == 1
    assert _get_auto_send(other) == 0


# --------------------------------------------------------------------------- #
# Auto-release OFF->ON cu garda de confirmare                                 #
# --------------------------------------------------------------------------- #

def test_off_to_on_fara_confirmare_nu_elibereaza(client):
    aid = _account_user("g1@test.com")
    csrf = _login(client, "g1@test.com")
    sid = _ins(aid, "queued", held=1)
    r = client.post("/auto-send", data={"enabled": "1", "csrf_token": csrf})
    assert r.status_code == 200
    # fara confirmare: NU comita ON, NU elibereaza
    assert _get_auto_send(aid) == 0
    assert _held(sid) == 1
    # raspunsul cere confirmare (modal)
    assert "confirm" in r.text.lower() or "trimit" in r.text.lower()


def test_off_to_on_cu_confirmare_elibereaza_scoped(client):
    aid = _account_user("g2@test.com", name="G2")
    other = _account_user("g2b@test.com", name="G2B")
    csrf = _login(client, "g2@test.com")
    s1 = _ins(aid, "queued", held=1)
    s2 = _ins(aid, "queued", held=1)
    s_other = _ins(other, "queued", held=1)
    r = client.post("/auto-send", data={"enabled": "1", "confirma": "1", "csrf_token": csrf})
    assert r.status_code == 200
    assert _get_auto_send(aid) == 1
    assert _held(s1) == 0
    assert _held(s2) == 0
    # cross-account izolare: randul altui cont ramane tinut
    assert _held(s_other) == 1


def test_off_to_on_fara_randuri_tinute_comite_direct(client):
    aid = _account_user("g3@test.com")
    csrf = _login(client, "g3@test.com")
    # niciun rand tinut -> nu are nevoie de confirmare
    r = client.post("/auto-send", data={"enabled": "1", "csrf_token": csrf})
    assert r.status_code == 200
    assert _get_auto_send(aid) == 1


# --------------------------------------------------------------------------- #
# Trimitere manuala per rand + bulk                                           #
# --------------------------------------------------------------------------- #

def test_trimite_acum_rand_tinut(client):
    aid = _account_user("t1@test.com")
    csrf = _login(client, "t1@test.com")
    sid = _ins(aid, "queued", held=1)
    r = client.post(f"/trimitere/{sid}/trimite-acum", data={"csrf_token": csrf})
    assert r.status_code == 200
    assert _held(sid) == 0


def test_trimite_acum_cross_account_404(client):
    aid = _account_user("t2@test.com", name="T2")
    other = _account_user("t2b@test.com", name="T2B")
    csrf = _login(client, "t2@test.com")
    sid_other = _ins(other, "queued", held=1)
    r = client.post(f"/trimitere/{sid_other}/trimite-acum", data={"csrf_token": csrf})
    assert r.status_code == 404
    assert _held(sid_other) == 1


def test_trimite_acum_non_queued_noop(client):
    aid = _account_user("t3@test.com")
    csrf = _login(client, "t3@test.com")
    sid = _ins(aid, "sent", held=0)
    r = client.post(f"/trimitere/{sid}/trimite-acum", data={"csrf_token": csrf})
    assert r.status_code == 200
    from app.db import get_connection
    conn = get_connection()
    try:
        assert conn.execute("SELECT status FROM submissions WHERE id=?", (sid,)).fetchone()["status"] == "sent"
    finally:
        conn.close()


def test_trimite_acum_csrf(client):
    aid = _account_user("t4@test.com")
    _login(client, "t4@test.com")
    sid = _ins(aid, "queued", held=1)
    r = client.post(f"/trimitere/{sid}/trimite-acum", data={"csrf_token": "gresit"})
    assert r.status_code == 403
    assert _held(sid) == 1


def test_trimite_toate_scoped(client):
    aid = _account_user("t5@test.com", name="T5")
    other = _account_user("t5b@test.com", name="T5B")
    csrf = _login(client, "t5@test.com")
    s1 = _ins(aid, "queued", held=1)
    s2 = _ins(aid, "queued", held=1)
    s_other = _ins(other, "queued", held=1)
    r = client.post("/trimite-toate", data={"csrf_token": csrf})
    assert r.status_code == 200
    assert _held(s1) == 0
    assert _held(s2) == 0
    assert _held(s_other) == 1


# --------------------------------------------------------------------------- #
# Eticheta held + buton Trimite in lista                                      #
# --------------------------------------------------------------------------- #

def test_rand_tinut_eticheta_si_buton(client):
    aid = _account_user("u1@test.com")
    _login(client, "u1@test.com")
    sid_tinut = _ins(aid, "queued", held=1)
    html = client.get("/_fragments/submissions").text
    assert "In asteptare (manual)" in html or "Manual" in html
    assert f"/trimitere/{sid_tinut}/trimite-acum" in html


def test_rand_ne_tinut_fara_buton(client):
    aid = _account_user("u2@test.com")
    _login(client, "u2@test.com")
    sid = _ins(aid, "queued", held=0)
    html = client.get("/_fragments/submissions").text
    assert f"/trimitere/{sid}/trimite-acum" not in html


# --------------------------------------------------------------------------- #
# Banner coada tinuta imbatranita + contor manual                             #
# --------------------------------------------------------------------------- #

def test_banner_aged_apare_pt_rand_vechi(client):
    aid = _account_user("b1@test.com")
    _login(client, "b1@test.com")
    _ins(aid, "queued", held=1, created_at="2026-06-01 08:00:00")  # >7 zile fata de 2026-07-05
    html = client.get("/_fragments/status").text
    assert "declarare obligatorie" in html.lower() or "tinute de" in html.lower()


def test_banner_aged_absent_pt_rand_recent(client):
    aid = _account_user("b2@test.com")
    _login(client, "b2@test.com")
    from datetime import datetime, timezone
    _ins(aid, "queued", held=1, created_at=datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S"))
    html = client.get("/_fragments/status").text
    assert "declarare obligatorie" not in html.lower()


def test_contor_manual_apare(client):
    aid = _account_user("b3@test.com")
    _login(client, "b3@test.com")
    _ins(aid, "queued", held=1)
    _ins(aid, "queued", held=1)
    html = client.get("/_fragments/status").text
    assert "manual" in html.lower()


# --------------------------------------------------------------------------- #
# Audit app_events                                                            #
# --------------------------------------------------------------------------- #

def _events(account_id, tip):
    from app.db import get_connection
    conn = get_connection()
    try:
        rows = conn.execute(
            "SELECT * FROM app_events WHERE tip=? AND account_id=?", (tip, account_id)
        ).fetchall()
        return rows
    finally:
        conn.close()


def test_audit_auto_send_schimbat(client):
    aid = _account_user("j1@test.com")
    csrf = _login(client, "j1@test.com")
    client.post("/auto-send", data={"enabled": "1", "csrf_token": csrf})
    assert len(_events(aid, "auto_send_schimbat")) >= 1


def test_audit_held_eliberat_rand(client):
    aid = _account_user("j2@test.com")
    csrf = _login(client, "j2@test.com")
    sid = _ins(aid, "queued", held=1)
    client.post(f"/trimitere/{sid}/trimite-acum", data={"csrf_token": csrf})
    assert len(_events(aid, "held_eliberat")) >= 1


def test_audit_held_eliberat_bulk(client):
    aid = _account_user("j3@test.com")
    csrf = _login(client, "j3@test.com")
    _ins(aid, "queued", held=1)
    _ins(aid, "queued", held=1)
    client.post("/trimite-toate", data={"csrf_token": csrf})
    evs = _events(aid, "held_eliberat")
    assert len(evs) >= 1


# --------------------------------------------------------------------------- #
# Stickiness filtru held, banner OOB, afordanta de eliberare in panoul de     #
# detaliu.                                                                    #
# --------------------------------------------------------------------------- #

def test_fragment_held_gol_nu_da_422(client):
    """Formularul include mereu `held` (gol cand filtrul e oprit) -> `held=` NU trebuie 422."""
    aid = _account_user("k1@test.com")
    _login(client, "k1@test.com")
    _ins(aid, "queued", held=0)
    resp = client.get("/_fragments/submissions?held=")
    assert resp.status_code == 200, resp.text[:200]


def test_fragment_held_1_filtreaza_si_persista_oob(client):
    """?held=1 -> doar randuri tinute + OOB #f-held=1 (sticky la reincarcari) + chip 'Arata tot'."""
    aid = _account_user("k2@test.com")
    _login(client, "k2@test.com")
    sid_tinut = _ins(aid, "queued", held=1)
    _ins(aid, "sent", held=0)
    resp = client.get("/_fragments/submissions?held=1")
    assert resp.status_code == 200
    # OOB sincronizeaza filtrul in form ca sa nu se piarda la trimiteriChanged/paginare.
    assert re.search(r'id="f-held"[^>]*value="1"[^>]*hx-swap-oob', resp.text) or \
           re.search(r'id="f-held"[^>]*hx-swap-oob[^>]*value="1"', resp.text), resp.text[:400]
    assert "Arata tot" in resp.text
    # Paginare (daca apare) pastreaza held=1.
    if "Paginare" in resp.text:
        assert "held=1" in resp.text


def test_fragment_lista_curata_reseteaza_f_held(client):
    """Reincarcarea listei fara filtre (dupa actiune) reseteaza #f-held la gol via OOB."""
    aid = _account_user("k3@test.com")
    csrf = _login(client, "k3@test.com")
    sid = _ins(aid, "queued", held=1)
    # trimite-acum -> _render_submissions (fara filtre) -> OOB f-held=""
    resp = client.post(f"/trimitere/{sid}/trimite-acum", data={"csrf_token": csrf})
    assert resp.status_code == 200
    assert re.search(r'id="f-held"[^>]*value=""[^>]*hx-swap-oob', resp.text) or \
           re.search(r'id="f-held"[^>]*hx-swap-oob[^>]*value=""', resp.text), resp.text[:400]


def test_banner_bulk_dispare_dupa_eliberare(client):
    """Banner 'Trimite toate (N)' e OOB (#bulk-held-banner-wrap): dupa eliberarea tuturor
    randurilor tinute, wrapper-ul revine gol (fara buton) — nu mai ramane stale."""
    aid = _account_user("k4@test.com")
    csrf = _login(client, "k4@test.com")
    _ins(aid, "queued", held=1)
    _ins(aid, "queued", held=1)
    # Inainte: fragmentul contine bannerul cu butonul.
    r0 = client.get("/_fragments/submissions")
    assert 'id="bulk-held-banner-wrap"' in r0.text
    assert "Trimite toate" in r0.text
    # Elibereaza toate -> wrapper OOB re-randat gol (fara buton).
    r1 = client.post("/trimite-toate", data={"csrf_token": csrf})
    assert r1.status_code == 200
    assert 'id="bulk-held-banner-wrap"' in r1.text
    assert "Trimite toate" not in r1.text


def test_detaliu_rand_tinut_are_buton_trimite_acum(client):
    """Panoul de detaliu al unui rand tinut (queued AND held=1) arata eticheta manuala +
    buton 'Trimite acum la RAR'."""
    aid = _account_user("k5@test.com")
    _login(client, "k5@test.com")
    sid = _ins(aid, "queued", held=1)
    resp = client.get(f"/_fragments/trimitere/{sid}")
    assert resp.status_code == 200, resp.text[:200]
    assert "Trimite acum la RAR" in resp.text
    assert f"/trimitere/{sid}/trimite-acum" in resp.text


def test_detaliu_rand_queued_neted_fara_buton(client):
    """Un rand queued NEtinut (held=0) NU arata butonul de eliberare in detaliu."""
    aid = _account_user("k6@test.com")
    _login(client, "k6@test.com")
    sid = _ins(aid, "queued", held=0)
    resp = client.get(f"/_fragments/trimitere/{sid}")
    assert resp.status_code == 200
    assert "Trimite acum la RAR" not in resp.text