import requests
import json
import uuid

BASE_URL = "http://localhost:5031/api/v1/auth"

def test_auth():
    # Random user to avoid conflicts
    unique_id = str(uuid.uuid4())[:8]
    email = f"testuser_{unique_id}@example.com"
    password = "Test@123Password"
    name = f"Test User {unique_id}"

    print(f"Testing with Email: {email}")

    # 1. Register
    register_payload = {
        "fullName": name,
        "email": email,
        "password": password,
        "confirmPassword": password
    }
    
    print("\n[POST] /register")
    try:
        reg_response = requests.post(f"{BASE_URL}/register", json=register_payload, verify=False)
        print(f"Status Code: {reg_response.status_code}")
        if reg_response.status_code == 200:
            print("SUCCESS: Registered")
        else:
            print(f"FAILED: {reg_response.text}")
            return
    except Exception as e:
        print(f"EXCEPTION: {e}")
        return

    # 2. Login
    login_payload = {
        "email": email,
        "password": password
    }

    print("\n[POST] /login")
    try:
        login_response = requests.post(f"{BASE_URL}/login", json=login_payload, verify=False)
        print(f"Status Code: {login_response.status_code}")
        if login_response.status_code == 200:
            print("SUCCESS: Logged in")
            token_data = login_response.json()
            print(f"Token received (length: {len(token_data.get('token', ''))})")
        else:
            print(f"FAILED: {login_response.text}")
    except Exception as e:
        print(f"EXCEPTION: {e}")

    # Extract token for subsequent requests
    token = ""
    if login_response.status_code == 200:
        token = login_response.json().get("accessToken")
    
    headers = {"Authorization": f"Bearer {token}"}
    API_ROOT = "http://localhost:5031/api/v1"

    # 3. Test Logout
    print("\n[POST] /auth/logout")
    try:
        logout_response = requests.post(f"{BASE_URL}/logout", headers=headers, verify=False)
        print(f"Status Code: {logout_response.status_code}")
        if logout_response.status_code == 200:
            print("SUCCESS: Logged out")
        else:
            print(f"FAILED: {logout_response.text}")
    except Exception as e:
        print(f"EXCEPTION: {e}")

    # Re-login for Role Tests
    print("\n[POST] /login (Re-login for Role Tests)")
    login_response = requests.post(f"{BASE_URL}/login", json=login_payload, verify=False)
    if login_response.status_code == 200:
        token = login_response.json().get("accessToken")
        headers = {"Authorization": f"Bearer {token}"}
        print("SUCCESS: Re-logged in")

    # 4. Test Role Management
    role_name = "TestRole1"
    
    # Create Role
    print(f"\n[POST] /role-management/roles (Create {role_name})")
    role_payload = {"name": role_name}
    try:
        create_role_response = requests.post(f"{API_ROOT}/role-management/roles", json=role_payload, headers=headers, verify=False)
        print(f"Status Code: {create_role_response.status_code}")
        if create_role_response.status_code == 200:
            print("SUCCESS: Role Created")
        else:
            print(f"FAILED: {create_role_response.text}")
    except Exception as e:
        print(f"EXCEPTION: {e}")

    # List Roles
    print("\n[GET] /role-management/roles")
    roles = []
    try:
        list_roles_response = requests.get(f"{API_ROOT}/role-management/roles", headers=headers, verify=False)
        print(f"Status Code: {list_roles_response.status_code}")
        if list_roles_response.status_code == 200:
            roles = list_roles_response.json()
            print(f"SUCCESS: Retrieved {len(roles)} roles")
            print(roles)
        else:
            print(f"FAILED: {list_roles_response.text}")
    except Exception as e:
        print(f"EXCEPTION: {e}")

    # 5. Test Permission Management
    role_id = next((r["id"] for r in roles if r["name"] == role_name), None)
    if role_id:
        permission = "Permissions.Users.View"
        print(f"\n[POST] /role-management/roles/{role_id}/permissions (Add {permission})")
        
        # Add Permission
        try:
            add_perm_response = requests.post(f"{API_ROOT}/role-management/roles/{role_id}/permissions", json=permission, headers=headers, verify=False)
            print(f"Status Code: {add_perm_response.status_code}")
            if add_perm_response.status_code == 200:
                print("SUCCESS: Permission Added")
            else:
                print(f"FAILED: {add_perm_response.text}")
        except Exception as e:
            print(f"EXCEPTION: {e}")

        # Get Permissions
        print(f"\n[GET] /role-management/roles/{role_id}/permissions")
        try:
            get_perm_response = requests.get(f"{API_ROOT}/role-management/roles/{role_id}/permissions", headers=headers, verify=False)
            print(f"Status Code: {get_perm_response.status_code}")
            if get_perm_response.status_code == 200:
                print(f"SUCCESS: Permissions: {get_perm_response.json()}")
            else:
                print(f"FAILED: {get_perm_response.text}")
        except Exception as e:
            print(f"EXCEPTION: {e}")

    # 6. Test Role Assignment to User
    # Need userId. Using unique_id to find the user from list or just use login response if it had ID (it didn't).
    # But Register didn't return ID.
    # However, we can use the "sub" claim if we decode the token, but we don't have a decoder here easily.
    # Alternatively, we can assume the user created is the one we want to assign to.
    # But wait, we don't have the User ID. 
    # Let's inspect the Login response.
    # login_response.json() usually returns { "accessToken": "...", "refreshToken": "..." }
    # Maybe we can fetch the user profile? There is no /me endpoint in AuthMap.
    # Hmmm. 
    # We can use the RoleMap endpoint "role-management/{role}/user/{userId}" only if we have userId.
    # We can't test this easily without User ID.
    # Let's Skip Role Assignment unless we can parse JWT.
    
    # 7. Test Refresh Token
    print("\n[POST] /auth/refresh")
    refresh_token = ""
    if login_response.status_code == 200:
        refresh_token = login_response.json().get("refreshToken")
    
    if refresh_token and token:
        refresh_payload = {
            "accessToken": token,
            "refreshToken": refresh_token
        }
        try:
            refresh_response = requests.post(f"{BASE_URL}/refresh", json=refresh_payload, verify=False)
            print(f"Status Code: {refresh_response.status_code}")
            if refresh_response.status_code == 200:
                print("SUCCESS: Token Refreshed")
                new_token = refresh_response.json().get("accessToken")
                # Update headers with new token
                headers = {"Authorization": f"Bearer {new_token}"}
            else:
                print(f"FAILED: {refresh_response.text}")
        except Exception as e:
            print(f"EXCEPTION: {e}")
    else:
        print("SKIPPING: No refresh token available")

    # 8. Password Reset (Sanity Check)
    print(f"\n[GET] /auth/password-reset-token/{email}")
    try:
        reset_response = requests.get(f"{BASE_URL}/password-reset-token/{email}", verify=False)
        print(f"Status Code: {reset_response.status_code}")
        if reset_response.status_code == 200:
            print("SUCCESS: Reset Token Request Sent (Check Logs/Email)")
        else:
            print(f"FAILED: {reset_response.text}")
    except Exception as e:
        print(f"EXCEPTION: {e}")

    # 9. Test Permission Deletion
    if role_id:
        permission = "Permissions.Users.View"
        print(f"\n[DELETE] /role-management/roles/{role_id}/permissions (Remove {permission})")
        try:
            # Note: DELETE with body is unusual but some APIs support it. The RoleMap uses [FromBody].
            # requests.delete(url, json=data) supports this.
            del_perm_response = requests.delete(
                f"{API_ROOT}/role-management/roles/{role_id}/permissions", 
                json=permission, 
                headers=headers, 
                verify=False
            )
            print(f"Status Code: {del_perm_response.status_code}")
            if del_perm_response.status_code == 200:
                print("SUCCESS: Permission Deleted")
            else:
                print(f"FAILED: {del_perm_response.text}")
        except Exception as e:
            print(f"EXCEPTION: {e}")

    # Delete Role
    if role_id:
        print(f"\n[DELETE] /role-management/roles/{role_id}")
        try:
            delete_role_response = requests.delete(f"{API_ROOT}/role-management/roles/{role_id}", headers=headers, verify=False)
            print(f"Status Code: {delete_role_response.status_code}")
            if delete_role_response.status_code == 200:
                print("SUCCESS: Role Deleted")
            else:
                print(f"FAILED: {delete_role_response.text}")
        except Exception as e:
            print(f"EXCEPTION: {e}")
    else:
        print("SKIPPING DELETE: Role ID not found")

    # 10. Logout (Clean up)
    print("\n[POST] /auth/logout")
    try:
        logout_response = requests.post(f"{BASE_URL}/logout", headers=headers, verify=False)
        print(f"Status Code: {logout_response.status_code}")
        if logout_response.status_code == 200:
            print("SUCCESS: Logged out")
        else:
            print(f"FAILED: {logout_response.text}")
    except Exception as e:
        print(f"EXCEPTION: {e}")

if __name__ == "__main__":
    test_auth()