"""
Shared pytest fixtures.

Runs the real app factory against in-memory SQLite. The server treats all
client-side crypto as opaque strings (auth_hash, enc_data, iv, enc_name), so
these tests can pass arbitrary values for them — no Web Crypto needed. The one
place real crypto matters is the recovery proof, which is plain HMAC-SHA256 and
is computed here exactly as recover.js does.
"""
import os
import sys

import pytest

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from app import create_app, db as _db  # noqa: E402


@pytest.fixture
def app():
    application = create_app('testing')
    with application.app_context():
        _db.create_all()
        yield application
        _db.session.remove()
        _db.drop_all()


@pytest.fixture
def client(app):
    return app.test_client()


@pytest.fixture
def db(app):
    return _db


# ── Helpers ──────────────────────────────────────────────────────────────────

def register(client, email='user@example.com', auth_hash='AUTH-HASH-V1',
             enc_key_salt='SALT-V1'):
    return client.post('/api/auth/register', json={
        'email': email, 'auth_hash': auth_hash, 'enc_key_salt': enc_key_salt,
    })


def login(client, email='user@example.com', auth_hash='AUTH-HASH-V1'):
    return client.post('/api/auth/login', json={'email': email, 'auth_hash': auth_hash})


def auth_headers(token):
    return {'Authorization': f'Bearer {token}'}


def make_user(client, email='user@example.com', auth_hash='AUTH-HASH-V1',
              enc_key_salt='SALT-V1'):
    """
    Register + log in. Returns (access_token, refresh_token).

    Registration answers 202 for both new and duplicate addresses so it cannot
    be used to probe account existence — see test_registration_privacy.py.
    """
    assert register(client, email, auth_hash, enc_key_salt).status_code == 202
    res = login(client, email, auth_hash)
    assert res.status_code == 200, res.get_json()
    body = res.get_json()
    return body['access_token'], body['refresh_token']


def add_item(client, token, name='password', enc_data='CT', iv='IV'):
    """Create a vault item. `name` is the server-side type label."""
    res = client.post('/api/vault', headers=auth_headers(token), json={
        'name': name, 'item_type': 'password',
        'enc_data': enc_data, 'iv': iv,
        'enc_name': 'ENCNAME', 'iv_name': 'IVNAME',
    })
    assert res.status_code == 201, res.get_json()
    return res.get_json()['id']