from fastapi import HTTPException

from app.api.upload import build_object_key, is_owned_upload_key, validate_image_upload
from app.config import settings, validate_security_settings


USER_ID = "a2d4447f-7b67-4304-ad9a-953007e75ef2"


def test_build_object_key_is_scoped_to_the_authenticated_user():
    object_key = build_object_key(USER_ID, "jpg")

    assert is_owned_upload_key(object_key, USER_ID)
    assert not is_owned_upload_key(object_key, "cf610b28-51a7-423d-a55a-730e193c9971")


def test_upload_rejects_non_image_content_type():
    try:
        validate_image_upload("payload.exe", "application/octet-stream")
    except HTTPException as exc:
        assert exc.status_code == 400
    else:
        raise AssertionError("non-image uploads must be rejected")


def test_upload_rejects_an_invalid_filename_extension():
    try:
        validate_image_upload("payload.txt", "image/jpeg")
    except HTTPException as exc:
        assert exc.status_code == 400
    else:
        raise AssertionError("invalid extensions must be rejected")


def test_production_rejects_placeholder_database_configuration(monkeypatch):
    monkeypatch.setattr(settings, "ENVIRONMENT", "production")
    monkeypatch.setattr(settings, "SECRET_KEY", "a" * 32)
    monkeypatch.setattr(settings, "DATABASE_URL", "postgresql+asyncpg://qiji_app:invalid@localhost:5432/qiji")
    monkeypatch.setattr(settings, "MINIO_ENDPOINT", "minio.example.test:9000")
    monkeypatch.setattr(settings, "MINIO_ACCESS_KEY", "qiji-app")
    monkeypatch.setattr(settings, "MINIO_SECRET_KEY", "a-secure-minio-secret")
    monkeypatch.setattr(settings, "MINIO_SECURE", True)

    try:
        validate_security_settings()
    except RuntimeError as exc:
        assert "DATABASE_URL" in str(exc)
    else:
        raise AssertionError("production configuration must reject placeholders")