"""Registration CAPTCHA is enforced for every fresh account when configured.

The gate used to be skipped whenever the request carried an `auth_key` — which
every real client sends (the password split) — so it protected nobody and a bot
skipped it by including the field. It now runs on `captcha.enabled` alone; the
desktop client is Chromium and renders the same widget.
"""

import pytest


@pytest.fixture
def captcha_on(client, monkeypatch):
    """Turn on a fake captcha: any config with both keys is `enabled`, and
    verification succeeds only for the token 'good-token'."""
    from meshbay_hub.api.users import _cfg
    monkeypatch.setattr(_cfg.captcha, "site_key", "test-site")
    monkeypatch.setattr(_cfg.captcha, "secret_key", "test-secret")

    async def fake_verify(secret, token, remote_ip=None, allowed_hosts=None,
                          allow_unattributed=False):
        return token == "good-token"

    monkeypatch.setattr("meshbay_hub.captcha.verify_captcha", fake_verify)


def _body(**over):
    b = {"username": "newbie", "email": "newbie@t.com", "auth_key": "a" * 44}
    b.update(over)
    return b


@pytest.mark.asyncio
async def test_missing_captcha_rejected_even_with_auth_key(client, captcha_on):
    r = await client.post("/v1/users/register", json=_body())
    assert r.status_code == 400
    assert r.json()["detail"] == "captcha_required"


@pytest.mark.asyncio
async def test_bad_captcha_rejected(client, captcha_on):
    r = await client.post("/v1/users/register",
                          json=_body(captcha_token="wrong"))
    assert r.status_code == 400
    assert r.json()["detail"] == "captcha_failed"


@pytest.mark.asyncio
async def test_good_captcha_accepted(client, captcha_on):
    r = await client.post("/v1/users/register",
                          json=_body(captcha_token="good-token"))
    assert r.status_code == 201


@pytest.mark.asyncio
async def test_no_captcha_configured_still_registers(client):
    # Default test config has no captcha keys — registration proceeds without one.
    r = await client.post("/v1/users/register", json=_body())
    assert r.status_code == 201