from __future__ import annotations

import sys
import unittest
from pathlib import Path

from fastapi.testclient import TestClient


META_ROOT = Path(__file__).resolve().parents[1]
RELEASE_ROOT = META_ROOT / "tools" / "release"
if str(RELEASE_ROOT) not in sys.path:
    sys.path.insert(0, str(RELEASE_ROOT))

from server.app import create_app  # noqa: E402


class ReleaseConsoleSecurityTests(unittest.TestCase):
    def test_api_token_is_accepted_only_from_header(self) -> None:
        with TestClient(create_app(workspace_root=META_ROOT, token="test-console-token")) as client:
            query_response = client.get("/api/health?token=test-console-token")
            header_response = client.get(
                "/api/health",
                headers={"X-Release-Console-Token": "test-console-token"},
            )

        self.assertEqual(query_response.status_code, 401)
        self.assertEqual(header_response.status_code, 200)

    def test_bootstrap_token_uses_and_clears_url_fragment(self) -> None:
        launcher = (RELEASE_ROOT / "release-console.py").read_text(encoding="utf-8")
        webui = (RELEASE_ROOT / "webui" / "index.html").read_text(encoding="utf-8")

        self.assertIn("#token={token}", launcher)
        self.assertNotIn("?token={token}", launcher)
        self.assertIn("window.location.hash.slice(1)", webui)
        self.assertIn("history.replaceState", webui)


if __name__ == "__main__":
    unittest.main()