"""Read-only checks through a temporary proxy, run inside the local API container."""
import base64
import json
import os
from urllib.error import HTTPError
from urllib.request import Request, urlopen


base = os.environ["RF4_PROXY_TEST_URL"]
token = os.environ["ADMIN_TOKEN"]
basic = "Basic " + base64.b64encode(b"route-test:hiccup").decode()


def probe(path, expected, authorization=None, method="GET", data=None):
    headers = {"Host": "localhost:8080"}
    if authorization:
        headers["Authorization"] = authorization
    if data is not None:
        headers["Content-Type"] = "application/json"
    request = Request(base + path, headers=headers, method=method, data=data)
    try:
        response = urlopen(request, timeout=15)
    except HTTPError as error:
        response = error
    with response:
        assert response.status == expected, f"{method} {path}: expected {expected}, got {response.status}"
        if path.startswith("/api/v1/admin/") and expected == 200:
            assert "no-store" in response.headers.get("Cache-Control", "")
            payload = json.load(response)
            if path.endswith("/media/catalog") or path.endswith("/source-status"):
                assert isinstance(payload, list)
            else:
                assert isinstance(payload, dict)
        if path == "/admin" or path.startswith("/admin/"):
            if expected == 200:
                assert "no-store" in response.headers.get("Cache-Control", "")
                assert "noindex" in response.headers.get("X-Robots-Tag", "")


probe("/admin", 401)
probe("/admin", 200, basic)
probe("/admin/moderation", 401)
probe("/admin/external-sources", 401)
probe("/admin/external-sources", 200, basic)
probe("/admin/media", 401)
probe("/admin/moderation", 200, basic)
probe("/admin/media", 200, basic)
# Clear any stale test-client auth failures before exercising rejection paths.
probe("/api/v1/admin/diagnostics", 200, "Bearer " + token)
probe("/api/v1/admin/media/catalog", 200, "Bearer " + token)
probe("/api/v1/admin/source-status", 200, "Bearer " + token)
for path in (
    "/api/v1/admin/diagnostics", "/api/v1/admin/catch-reports",
    "/api/v1/admin/media/catalog", "/api/v1/admin/source-status",
):
    probe(path, 401)
# Invalid UUID prevents writes while checking the moderation request path.
probe("/api/v1/admin/catch-reports/not-a-uuid", 422, "Bearer " + token,
      method="PATCH", data=b'{"status":"approved"}')
print("Admin auth passed: Basic pages, Bearer API, rejected missing/wrong credentials")