"""美团/京东 CPS 落地页「领券前授权头像」插页(/c/{code})。

验证:微信内未授权头像 → 出插页(snsapi_userinfo 按钮 + 「直接领券」出口);
已授权(wx_uinfo cookie) / 非微信 → 直接 302 跳 target。
插页只渲染 HTML、不真调微信,故无需 mock 微信网络。
"""
from __future__ import annotations

import pytest

from app.core.config import settings
from app.db.session import SessionLocal
from app.repositories import cps_link as cps_link_repo

_WECHAT_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) MicroMessenger/8.0.40"
_OTHER_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) Safari/605.1"


@pytest.fixture()
def _wx_oauth_on(monkeypatch):
    """打开微信网页授权(插页只在 settings.wx_oauth_active 时出)。"""
    monkeypatch.setattr(settings, "WX_MP_APPID", "wxtestappid")
    monkeypatch.setattr(settings, "WX_MP_SECRET", "wxtestsecret")
    monkeypatch.setattr(settings, "WX_MP_OAUTH_ENABLED", True)
    monkeypatch.setattr(settings, "CPS_REDIRECT_BASE", "https://coupon.example.com")


def _make_link(platform: str, target: str) -> tuple[str, str]:
    with SessionLocal() as db:
        link = cps_link_repo.create_link(
            db, group_id=1, activity_id=1,
            sid="g1" if platform == "meituan" else None,
            target_url=target, platform=platform,
        )
        return link.code, link.target_url


@pytest.mark.parametrize("platform,target", [
    ("meituan", "https://dpurl.cn/mt-abc"),
    ("jd", "https://u.jd.com/jd-xyz"),
])
def test_wechat_unauthorized_shows_interstitial(client, _wx_oauth_on, platform, target):
    """微信内 + 有 openid + 无 wx_uinfo → 200 插页:userinfo 授权按钮 + 直接领券出口。"""
    code, tgt = _make_link(platform, target)
    r = client.get(
        f"/c/{code}",
        headers={"user-agent": _WECHAT_UA, "cookie": "wx_openid=o_test"},
        follow_redirects=False,
    )
    assert r.status_code == 200, r.text
    body = r.text
    assert "snsapi_userinfo" in body   # 唯一按钮走 userinfo 授权(交互手势触发)
    assert code in body                # 授权 state=uinfo:{code}
    assert tgt in body                 # 取消授权时前端转跳的目标券页(绝不阻断领券)
    assert "暂不授权" not in body       # 已去掉单独的"暂不授权"出口,改为取消即自动转跳


def test_authorized_redirects_to_target(client, _wx_oauth_on):
    """已授权头像(wx_uinfo=1)→ 不再出插页,直接 302 跳 target。"""
    code, tgt = _make_link("meituan", "https://dpurl.cn/mt-ok")
    r = client.get(
        f"/c/{code}",
        headers={"user-agent": _WECHAT_UA, "cookie": "wx_openid=o_test; wx_uinfo=1"},
        follow_redirects=False,
    )
    assert r.status_code == 302
    assert r.headers["location"] == tgt


def test_non_wechat_redirects_to_target(client, _wx_oauth_on):
    """非微信浏览器(拿不了授权)→ 直接 302 跳 target,不出插页。"""
    code, tgt = _make_link("meituan", "https://dpurl.cn/mt-other")
    r = client.get(
        f"/c/{code}",
        headers={"user-agent": _OTHER_UA, "cookie": "wx_openid=o_test"},
        follow_redirects=False,
    )
    assert r.status_code == 302
    assert r.headers["location"] == tgt


def test_oauth_cb_cancel_no_code_redirects_back(client):
    """授权弹窗点「取消」、微信带空 code 回调 → 兜底 302 回落地页(不报 422)。
    落地页再由前端转跳目标券页,保证拒绝也能拿到券。"""
    r = client.get("/wx/oauth/cb?state=uinfo:ABC123", follow_redirects=False)
    assert r.status_code == 302
    assert r.headers["location"] == "/c/ABC123"