"""
Tests d'intégration des routes Flask — IT-01 à IT-10 (client de test Flask).

Vérifient le comportement HTTP complet (routes -> services -> models -> DB
réelle), avec et sans authentification/autorisation.
"""

import json


def test_it01_annonces_sans_auth_401(client):
    resp = client.get("/api/annonces")
    assert resp.status_code == 401


def test_it02_annonces_avec_auth_200(user_session):
    resp = user_session.get("/api/annonces")
    assert resp.status_code == 200
    assert resp.get_json() == []


def test_it03_creer_annonce_non_admin_403(user_session):
    resp = user_session.post("/api/annonces", json={"titre": "T", "contenu": "C"})
    assert resp.status_code == 403


def test_it04_creer_annonce_admin_201_puis_visible(admin_session):
    resp = admin_session.post("/api/annonces", json={"titre": "Annonce test", "contenu": "Contenu"})
    assert resp.status_code == 201
    resp_list = admin_session.get("/api/annonces")
    titres = [a["titre"] for a in resp_list.get_json()]
    assert "Annonce test" in titres


def test_it05_modifier_annonce_admin_200(admin_session):
    created = admin_session.post("/api/annonces", json={"titre": "A", "contenu": "B"}).get_json()
    resp = admin_session.put(f"/api/annonces/{created['id']}", json={"titre": "A2", "contenu": "B2"})
    assert resp.status_code == 200


def test_it06_supprimer_annonce_admin_200(admin_session):
    created = admin_session.post("/api/annonces", json={"titre": "A", "contenu": "B"}).get_json()
    resp = admin_session.delete(f"/api/annonces/{created['id']}")
    assert resp.status_code == 200


def test_it07_is_admin_reflete_groupes(admin_session, user_session):
    assert admin_session.get("/api/is_admin").get_json()["admin"] is True
    assert user_session.get("/api/is_admin").get_json()["admin"] is False


def test_it08_upload_sans_fichier_400(user_session):
    resp = user_session.post("/api/fichiers/upload", data={})
    assert resp.status_code == 400


def test_it09_evenement_dates_invalides_400(admin_session):
    resp = admin_session.post(
        "/api/evenements",
        json={"titre": "Réunion", "date_debut": "2026-09-10T10:00:00", "date_fin": "2026-09-09T10:00:00"},
    )
    assert resp.status_code == 400


def test_it10_accueil_sans_session_redirige_login(client):
    resp = client.get("/", follow_redirects=False)
    assert resp.status_code == 302
    assert "/login" in resp.headers["Location"]


def test_it04b_creer_annonce_titre_manquant_400(admin_session):
    resp = admin_session.post("/api/annonces", json={"contenu": "Sans titre"})
    assert resp.status_code == 400