"""Tests for v1 vault API (async, uses shared conftest)."""

from __future__ import annotations

import pytest


async def _token(client) -> str:
    r = await client.post(
        "/api/v1/auth/register",
        json={"username": "vault_user", "password": "password123"},
    )
    if r.status_code == 409:
        r = await client.post(
            "/api/v1/auth/login",
            json={"username": "vault_user", "password": "password123"},
        )
    assert r.status_code in (200, 201), r.text
    return r.json()["token"]


@pytest.mark.asyncio
async def test_health(client):
    r = await client.get("/api/v1/health")
    assert r.status_code == 200
    body = r.json()
    assert body["api"] == "v1"
    assert "vault" in body["features"]


@pytest.mark.asyncio
async def test_vault_roundtrip(client, tmp_path, monkeypatch):
    from badnote_server.config import settings

    monkeypatch.setattr(settings, "vault_path", str(tmp_path / "vaults"))

    token = await _token(client)
    headers = {"Authorization": f"Bearer {token}"}

    files = {"upload": ("hello.txt", b"hello vault", "text/plain")}
    r = await client.put(
        "/api/v1/vault/files/NotebookA/hello.txt",
        headers=headers,
        files=files,
    )
    assert r.status_code == 200, r.text
    assert r.json()["path"] == "NotebookA/hello.txt"
    assert r.json()["size"] == 11

    r = await client.get("/api/v1/vault/manifest", headers=headers)
    assert r.status_code == 200
    paths = [f["path"] for f in r.json()["files"]]
    assert "NotebookA/hello.txt" in paths

    r = await client.get(
        "/api/v1/vault/files/NotebookA/hello.txt",
        headers=headers,
    )
    assert r.status_code == 200
    assert r.content == b"hello vault"

    r = await client.delete(
        "/api/v1/vault/files/NotebookA/hello.txt",
        headers=headers,
    )
    assert r.status_code == 200
    r = await client.get(
        "/api/v1/vault/files/NotebookA/hello.txt",
        headers=headers,
    )
    assert r.status_code == 404


@pytest.mark.asyncio
async def test_path_escape_rejected(client, tmp_path, monkeypatch):
    from badnote_server.config import settings

    monkeypatch.setattr(settings, "vault_path", str(tmp_path / "vaults"))

    token = await _token(client)
    headers = {"Authorization": f"Bearer {token}"}
    files = {"upload": ("x", b"nope", "application/octet-stream")}
    r = await client.put(
        "/api/v1/vault/files/../../etc/passwd",
        headers=headers,
        files=files,
    )
    assert r.status_code in (400, 404)