import pytest
from django.conf import settings
from django.test import override_settings

from infrasynth.audit.models import ModelChangeLog, SecurityEvent
from infrasynth.audit.signals import security_event_occurred
from infrasynth.security.models import Role


def audit_config(**overrides):
    return {**settings.INFRASYNTH_AUDIT, **overrides}


@pytest.fixture
def role(db):
    return Role.objects.create(name="Test Role", slug="test-role", permissions=[])


class TestModelCreateTracking:
    def test_create_logs_entry(self, role):
        log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
        assert log.object_id == str(role.pk)
        assert log.action == "create"
        assert "name" in log.changes
        assert log.changes["name"] == [None, "Test Role"]

    def test_create_changes_include_serialized_fields(self, role):
        log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
        assert log.changes["slug"] == [None, "test-role"]
        assert log.changes["permissions"] == [None, "[]"]

    def test_create_actor_none_without_actor_field(self, role):
        log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
        assert log.actor is None


class TestModelUpdateTracking:
    def test_update_logs_field_changes(self, role):
        role._previous_state = Role.objects.get(pk=role.pk)
        role.name = "Renamed Role"
        role.save()

        logs = ModelChangeLog.objects.filter(
            model_label="infrasynth_security.Role",
            object_id=str(role.pk),
            action="update",
        )
        assert logs.count() == 1
        assert logs.first().changes["name"] == ["Test Role", "Renamed Role"]

    def test_no_changes_does_not_log(self, role):
        role._previous_state = Role.objects.get(pk=role.pk)
        role.save()

        assert not ModelChangeLog.objects.filter(
            model_label="infrasynth_security.Role",
            object_id=str(role.pk),
            action="update",
        ).exists()

    def test_update_logged_without_manual_snapshot(self, role):
        role.name = "Changed Automatically"
        role.save()

        log = ModelChangeLog.objects.get(
            model_label="infrasynth_security.Role",
            object_id=str(role.pk),
            action="update",
        )
        assert log.changes["name"] == ["Test Role", "Changed Automatically"]


class TestModelDeleteTracking:
    def test_delete_logs_entry(self, role):
        pk = role.pk
        role.delete()

        log = ModelChangeLog.objects.get(
            model_label="infrasynth_security.Role",
            object_id=str(pk),
            action="delete",
        )
        assert log.action == "delete"


class TestConfiguration:
    @override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_MODELS=["infrasynth_security.Role"]))
    def test_excluded_model_not_logged(self, db):
        Role.objects.create(name="Excluded", slug="excluded")
        assert not ModelChangeLog.objects.filter(model_label="infrasynth_security.Role").exists()

    @override_settings(INFRASYNTH_AUDIT=audit_config(EXCLUDED_FIELDS=["name", "slug"]))
    def test_excluded_fields_not_in_changes(self, db):
        Role.objects.create(name="Field", slug="field")
        log = ModelChangeLog.objects.get(model_label="infrasynth_security.Role")
        assert "name" not in log.changes
        assert "slug" not in log.changes
        assert "is_system" in log.changes

    @override_settings(INFRASYNTH_AUDIT=audit_config(ENABLE_MODEL_CHANGE_TRACKING=False))
    def test_tracking_disabled(self, db):
        Role.objects.create(name="No Track", slug="no-track")
        assert not ModelChangeLog.objects.filter(model_label="infrasynth_security.Role").exists()

    @override_settings(INFRASYNTH_AUDIT=audit_config(ENABLE_SECURITY_EVENTS=False))
    def test_security_events_disabled(self, db):
        security_event_occurred.send(
            sender=Role,
            event_type="test",
            actor=None,
            ip_address=None,
            metadata={},
        )
        assert not SecurityEvent.objects.exists()


class TestSecurityEvents:
    def test_security_event_creates_log(self, db, user):
        security_event_occurred.send(
            sender=Role,
            event_type="login_failed",
            actor=user,
            ip_address="127.0.0.1",
            metadata={"reason": "bad_password"},
        )
        event = SecurityEvent.objects.get(event_type="login_failed")
        assert event.actor == user
        assert event.ip_address == "127.0.0.1"
        assert event.metadata == {"reason": "bad_password"}
        assert event.request_id