from __future__ import annotations

from datetime import datetime, timezone
from unittest.mock import MagicMock, patch

import pytest
from fastapi import HTTPException
from sqlalchemy import create_engine, select
from sqlalchemy.orm import Session

from app.database import Base
from app.main import _check_rate_limit, _is_trusted_proxy
from app.models import SubmissionAttempt


def test_rate_limit_is_persistent_and_does_not_store_raw_client() -> None:
    engine = create_engine("sqlite://")
    Base.metadata.create_all(engine)
    with Session(engine) as db:
        for _ in range(5):
            mock_request = MagicMock()
            mock_request.client.host = "203.0.113.42"
            mock_request.headers.get.return_value = None
            _check_rate_limit(mock_request, db)
        with pytest.raises(HTTPException) as blocked:
            mock_request = MagicMock()
            mock_request.client.host = "203.0.113.42"
            mock_request.headers.get.return_value = None
            _check_rate_limit(mock_request, db)
        assert blocked.value.status_code == 429
        attempts = list(db.scalars(select(SubmissionAttempt)))
        assert len(attempts) == 5
        assert all(item.client_hash != "203.0.113.42" and len(item.client_hash) == 64 for item in attempts)
        assert all(item.created_at.replace(tzinfo=timezone.utc) <= datetime.now(timezone.utc) for item in attempts)


def test_rate_limit_uses_forwarded_for_header_from_trusted_proxy() -> None:
    """X-Forwarded-For should be used when client is trusted proxy."""
    engine = create_engine("sqlite://")
    Base.metadata.create_all(engine)
    with Session(engine) as db:
        with patch("app.main.settings") as mock_settings:
            mock_settings.rate_limit_secret = "test-secret-for-testing"
            mock_settings.trusted_proxy_cidrs = ["127.0.0.1/32"]
            mock_proxy = MagicMock()
            mock_proxy.client.host = "127.0.0.1"
            mock_proxy.headers.get.return_value = "198.51.100.10"
            for _ in range(5):
                _check_rate_limit(mock_proxy, db)
            with pytest.raises(HTTPException) as blocked:
                mock_other = MagicMock()
                mock_other.client.host = "127.0.0.1"
                mock_other.headers.get.return_value = "198.51.100.10"
                _check_rate_limit(mock_other, db)
            assert blocked.value.status_code == 429


def test_trusted_proxy_checks_cidrs() -> None:
    assert _is_trusted_proxy("127.0.0.1", ["127.0.0.1/32"]) is True
    assert _is_trusted_proxy("10.0.0.1", ["10.0.0.0/8"]) is True
    assert _is_trusted_proxy("192.168.1.1", ["192.168.1.0/24"]) is True
    assert _is_trusted_proxy("::1", ["::1/128"]) is True
    assert _is_trusted_proxy("203.0.113.5", ["127.0.0.1/32"]) is False
    assert _is_trusted_proxy("invalid", []) is False


def test_rate_limit_ignores_forwarded_for_from_untrusted_client() -> None:
    """X-Forwarded-For should be ignored when client is not in trusted CIDRs."""
    engine = create_engine("sqlite://")
    Base.metadata.create_all(engine)
    with Session(engine) as db:
        # Client 203.0.113.42 is NOT trusted by default
        mock_untrusted = MagicMock()
        mock_untrusted.client.host = "203.0.113.42"
        mock_untrusted.headers.get.return_value = "10.0.0.99"
        for i in range(3):
            _check_rate_limit(mock_untrusted, db)
        # Should use real client 203.0.113.42, not forwarded 10.0.0.99
        # So 3 attempts from 203.0.113.42 should be allowed (limit is 5)
        mock_different = MagicMock()
        mock_different.client.host = "203.0.113.42"
        mock_different.headers.get.return_value = "10.0.0.88"
        _check_rate_limit(mock_different, db)  # Should succeed, not blocked


def test_rate_limit_uses_forwarded_for_from_trusted_proxy() -> None:
    """X-Forwarded-For should be used when client IS in trusted CIDRs."""
    engine = create_engine("sqlite://")
    Base.metadata.create_all(engine)
    with Session(engine) as db:
        # 127.0.0.1 IS trusted by default
        with patch("app.main.settings") as mock_settings:
            mock_settings.rate_limit_secret = "test-secret-for-testing"
            mock_settings.trusted_proxy_cidrs = ["127.0.0.1/32", "::1/128"]
            mock_proxy = MagicMock()
            mock_proxy.client.host = "127.0.0.1"
            mock_proxy.headers.get.return_value = "203.0.113.100"
            for _ in range(5):
                _check_rate_limit(mock_proxy, db)
            # Should use forwarded IP 203.0.113.100, so a different forwarded IP should be allowed
            mock_other_forwarded = MagicMock()
            mock_other_forwarded.client.host = "127.0.0.1"
            mock_other_forwarded.headers.get.return_value = "198.51.100.50"
            _check_rate_limit(mock_other_forwarded, db)  # Should succeed