from django.contrib.auth.models import User
from django.test import TestCase
from django.urls import reverse
from django.utils import timezone

from rides.models import Fahrgast, Profile, Ride, RideStatus, Role

SECRET = "PFLEGEHINWEIS-GEHEIM-XYZ"


class VisibilityTests(TestCase):
    def setUp(self):
        self.pilot_a = User.objects.create_user("pilot_a", first_name="Anton")
        self.pilot_b = User.objects.create_user("pilot_b", first_name="Berta")
        Profile.objects.create(user=self.pilot_a, role=Role.PILOT)
        Profile.objects.create(user=self.pilot_b, role=Role.PILOT)
        self.fahrgast = Fahrgast.objects.create(name="Herr K.", mobility_notes=SECRET)
        self.ride = Ride.objects.create(
            fahrgast=self.fahrgast,
            scheduled_at=timezone.now(),
            assigned_pilot=self.pilot_a,
            status=RideStatus.CLAIMED,
            pickup_label="A",
            pickup_lat=49.25,
            pickup_lng=6.96,
            dest_label="B",
            dest_lat=49.23,
            dest_lng=6.99,
        )

    def test_foreign_pilot_cannot_view_assigned_ride(self):
        self.client.force_login(self.pilot_b)
        resp = self.client.get(reverse("ride_detail", args=[self.ride.pk]))
        self.assertEqual(resp.status_code, 403)

    def test_foreign_pilot_never_sees_notes(self):
        self.client.force_login(self.pilot_b)
        resp = self.client.get(reverse("ride_detail", args=[self.ride.pk]))
        self.assertNotContains(resp, SECRET, status_code=403)

    def test_assigned_pilot_sees_notes(self):
        self.client.force_login(self.pilot_a)
        resp = self.client.get(reverse("ride_detail", args=[self.ride.pk]))
        self.assertContains(resp, SECRET)

    def test_open_ride_visible_to_any_pilot(self):
        self.ride.assigned_pilot = None
        self.ride.status = RideStatus.REQUESTED
        self.ride.save()
        self.client.force_login(self.pilot_b)
        resp = self.client.get(reverse("ride_detail", args=[self.ride.pk]))
        self.assertEqual(resp.status_code, 200)

    def test_geojson_respects_visibility(self):
        # Eine fremde, vergebene Fahrt darf NICHT in der Karten-API eines
        # anderen Piloten auftauchen (HIGH-Finding aus dem Code-Review).
        self.ride.pickup_label = "GEHEIM-ABHOLORT"
        self.ride.save()
        self.client.force_login(self.pilot_b)
        resp = self.client.get(reverse("rides_geojson"))
        self.assertNotContains(resp, "GEHEIM-ABHOLORT")
        # die zugeteilte Pilot:in sieht sie sehr wohl
        self.client.force_login(self.pilot_a)
        resp = self.client.get(reverse("rides_geojson"))
        self.assertContains(resp, "GEHEIM-ABHOLORT")