"""Scan-to-connect endpoints: /v1/connect/info and /v1/connect/qr (admin-only)."""
from __future__ import annotations

from conftest import ADMIN_AUTH, INVITE_CODE


def test_connect_info_admin(client):
    r = client.get("/v1/connect/info", headers=ADMIN_AUTH)
    assert r.status_code == 200, r.text
    data = r.json()
    assert data["invite_code"] == INVITE_CODE
    assert data["base_urls"], "expected at least one candidate URL"
    for u in data["base_urls"]:
        assert u.endswith("/app")


def test_connect_info_forbidden_without_admin(client, member_auth):
    assert client.get("/v1/connect/info", headers=member_auth).status_code == 403
    assert client.get("/v1/connect/info").status_code == 401


def test_connect_qr_svg_admin(client):
    r = client.get("/v1/connect/qr", headers=ADMIN_AUTH)
    assert r.status_code == 200, r.text
    assert r.headers["content-type"].startswith("image/svg+xml")
    body = r.text
    assert body.startswith("<?xml") or "<svg" in body
    assert "path" in body  # QR modules are rendered as a path


def test_connect_qr_host_override(client):
    r = client.get("/v1/connect/qr", params={"host": "192.168.9.9"}, headers=ADMIN_AUTH)
    assert r.status_code == 200
    assert r.headers["content-type"].startswith("image/svg+xml")


def test_connect_qr_forbidden_without_admin(client, member_auth):
    assert client.get("/v1/connect/qr", headers=member_auth).status_code == 403


def test_connect_info_https_uses_request_host(client, monkeypatch):
    """Behind TLS (Caddy) the request's own Host is the address phones should use."""
    hdrs = {**ADMIN_AUTH, "Host": "sync.example.com", "X-Forwarded-Proto": "https"}
    r = client.get("/v1/connect/info", headers=hdrs)
    assert r.status_code == 200
    assert r.json()["base_urls"] == ["https://sync.example.com/app"]