"""Login tracking and the staff activity view (the client's explicit request)."""
from django.contrib.auth import get_user_model
from django.test import TestCase
from django.urls import NoReverseMatch, reverse

from accounts.models import LoginEvent

User = get_user_model()


class LoginTrackingTests(TestCase):
    def setUp(self):
        self.owner = User.objects.create_user(username="owner", password="pw-owner-12345")

    def test_successful_login_is_recorded(self):
        self.client.post(
            reverse("login"), {"username": "owner", "password": "pw-owner-12345"}, secure=True
        )
        event = LoginEvent.objects.get(username="owner")
        self.assertTrue(event.succeeded)
        self.assertIsNotNone(event.ip)
        self.assertEqual(event.user, self.owner)

    def test_failed_login_is_recorded(self):
        self.client.post(
            reverse("login"), {"username": "owner", "password": "wrong"}, secure=True
        )
        event = LoginEvent.objects.get(username="owner")
        self.assertFalse(event.succeeded)
        self.assertIsNone(event.user)

    def test_failed_login_for_unknown_account_is_still_recorded(self):
        self.client.post(
            reverse("login"), {"username": "nosuchuser", "password": "x"}, secure=True
        )
        self.assertTrue(LoginEvent.objects.filter(username="nosuchuser", succeeded=False).exists())

    def test_password_is_never_stored(self):
        self.client.post(
            reverse("login"), {"username": "owner", "password": "SuperSecret123"}, secure=True
        )
        for event in LoginEvent.objects.all():
            self.assertNotIn("SuperSecret123", str(event.__dict__))


class ActivityTrailTests(TestCase):
    """The staff-facing Activity page was removed; the trail behind it was not.

    Sign-ins and downloads are still recorded — the data is there if it is ever
    wanted, and DownloadLog is what the per-user download rate limit counts.
    So the test is that the page is unreachable and the rows keep arriving.
    """

    def test_the_activity_page_no_longer_exists(self):
        with self.assertRaises(NoReverseMatch):
            reverse("documents:activity")

    def test_sign_ins_are_still_recorded_without_a_page_to_show_them(self):
        User.objects.create_user(username="owner", password="pw-owner-12345")
        self.client.post(
            reverse("login"), {"username": "owner", "password": "pw-owner-12345"}, secure=True
        )
        self.assertTrue(LoginEvent.objects.filter(username="owner", succeeded=True).exists())