"""Tests — nonces CSP (ROADMAP #87 T5b).

- `inject_csp_nonce` ne touche que les scripts inline exécutables
  (`<script>`, `type="module"` / `type="importmap"` sans `src`), jamais les
  blocs de données (`type="text/plain"`) ni les scripts externes.
- Chaque page HTML servie avec des scripts inline les porte tous avec un
  nonce après injection.
"""

from __future__ import annotations

import re
from pathlib import Path

ROOT = Path(__file__).resolve().parent.parent
NONCE = "TESTNONCE1234567890"


def _read(name: str) -> str:
    return (ROOT / "frontend" / name).read_text(encoding="utf-8")


def test_inject_only_bare_executable_scripts():
    from backend.csp import inject_csp_nonce

    html = (
        "<script>var a = 1;</script>"
        '<script type="module">import x from "y";</script>'
        '<script type="importmap">{"imports": {}}</script>'
        '<script type="module" src="/static/js/app.js"></script>'
        '<script src="https://cdnjs.cloudflare.com/x.js"></script>'
        '<script id="raw-content" type="text/plain">hello</script>'
        '<script nonce="OLD">var b = 2;</script>'
    )
    out = inject_csp_nonce(html, NONCE)
    assert out.count(f'nonce="{NONCE}"') == 3
    assert '<script src="https://cdnjs.cloudflare.com/x.js">' in out
    assert '<script id="raw-content" type="text/plain">' in out
    assert '<script nonce="OLD">' in out


def test_new_nonce_unique_per_call():
    from backend.csp import new_nonce

    assert new_nonce() != new_nonce()


def test_all_pages_fully_nonced():
    """Aucun script inline exécutable sans nonce après injection (sauf src=)."""
    from backend.csp import inject_csp_nonce

    for name in ("index.html", "popout.html", "admin.html", "editor-poc.html", "excalidraw-editor.html"):
        out = inject_csp_nonce(_read(name), NONCE)
        bare = re.findall(r"<script>", out)
        assert not bare, f"{name} : scripts sans nonce restants"
        inline_mods = [m for m in re.findall(r'<script type="(?:module|importmap)">', out)]
        assert not inline_mods, f"{name} : modules/importmap sans nonce restants"


def _nonce_of(csp: str) -> str | None:
    m = re.search(r"'nonce-([^']+)'", csp or "")
    return m.group(1) if m else None


def test_nonce_header_fresh_per_response(client):
    """Chaque réponse porte un nonce frais dans `script-src`."""
    r1 = client.get("/")
    r2 = client.get("/")
    n1, n2 = _nonce_of(r1.headers.get("content-security-policy")), _nonce_of(
        r2.headers.get("content-security-policy")
    )
    assert n1 and n2 and n1 != n2


def test_nonce_matches_injected_html(client):
    """Le nonce de l'en-tête est celui injecté dans le HTML (`/`, excalidraw)."""
    for path in ("/", "/excalidraw-editor.html"):
        resp = client.get(path)
        assert resp.status_code == 200, path
        nonce = _nonce_of(resp.headers.get("content-security-policy"))
        assert nonce, path
        assert f'nonce="{nonce}"' in resp.text, path


def test_docs_inline_script_nonced(client):
    """BUG-106 : /docs (script inline d'init Swagger) porte le nonce de son
    en-tête — sinon script-src sans 'unsafe-inline' rend la page blanche."""
    resp = client.get("/docs")
    assert resp.status_code == 200
    nonce = _nonce_of(resp.headers.get("content-security-policy"))
    assert nonce
    assert f'nonce="{nonce}"' in resp.text, "/docs : script inline sans nonce"
    # Le bundle externe (jsdelivr) reste tel quel, couvert par script-src.
    assert "<script src=" in resp.text


def test_redoc_served_with_csp(client):
    """/redoc n'a aucun script inline (bundle externe seul) : il est servi
    avec sa CSP sans aucune injection nécessaire."""
    resp = client.get("/redoc")
    assert resp.status_code == 200
    assert _nonce_of(resp.headers.get("content-security-policy"))
    assert "<script src=" in resp.text
    assert "<script nonce=" not in resp.text


def test_docs_external_bundle_not_nonced(client):
    """L'injection ne touche que les balises <script> exécutables sans src."""
    from backend.csp import inject_csp_nonce

    html = '<script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/x.js"></script><script>init()</script>'
    out = inject_csp_nonce(html, NONCE)
    assert out.count(f'nonce="{NONCE}"') == 1
    assert '<script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/x.js">' in out