from conftest import ADMIN_PASSWORD


async def test_login_success_and_failure_are_audited(client, admin_token):
    await client.post("/api/admin/login", json={"password": "wrong-password-xyz"})
    await client.post("/api/admin/login", json={"password": ADMIN_PASSWORD})

    # Sans X-School l'opérateur voit les événements de toutes les écoles (dont les connexions).
    r = await client.get("/api/admin/audit?action=auth.login&limit=50",
                         headers={"Authorization": f"Bearer {admin_token}"})
    assert r.status_code == 200
    actions = {e["action"] for e in r.json()["events"]}
    assert "auth.login" in actions
    assert "auth.login_failed" in actions


async def test_audit_export_csv(client, admin_headers):
    r = await client.get("/api/admin/audit/export.csv", headers=admin_headers)
    assert r.status_code == 200
    assert "text/csv" in r.headers["content-type"]
    assert "action" in r.text.splitlines()[0]


async def test_audit_requires_a_token(client):
    assert (await client.get("/api/admin/audit")).status_code == 401


async def test_director_only_sees_own_school_events(client, director_headers):
    from services import audit_service
    audit_service.log_event("test.marker", school_id="autre-ecole", severity="info")
    audit_service.log_event("test.marker", school_id="ecole-test", severity="info")
    r = await client.get("/api/admin/audit?action=test.marker", headers=director_headers)
    assert r.status_code == 200
    schools = {e["school_id"] for e in r.json()["events"]}
    assert schools == {"ecole-test"}