"""
A signed-in person is never shown the sign-in form.

Found live on meshbay.org (2026-09-14): a browser already signed in as one
account opened on `#/login` — a hash left in the address bar, restored with the
session — and the router drew the login form, prefilled by the browser with
another account's name and passphrase, under a navigation bar and a sidebar
that already showed the first account and its Administration entry. The router
tested the route before it tested for a user.

Source-level, as the other routing guards here are: the SPA has no component
test harness, and the whole defect is the order of two conditions.
"""

import re
from pathlib import Path

import pytest

STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
APP = STATIC / "app.js"

pytestmark = pytest.mark.skipif(not APP.exists(), reason="SPA sources unavailable")


@pytest.fixture(scope="module")
def app_body() -> str:
    source = APP.read_text(encoding="utf-8")
    start = source.index("\nfunction App() {")
    return source[start:source.index("\n}\n", start)]


def _branch_rendering(body: str, page: str) -> str:
    """The `else if (...)` condition of the branch that renders `page`."""
    at = body.index(f"<${{{page}}}")
    head = body.rindex("} else if (", 0, at)
    return body[head:body.index("{\n", head)]


def test_the_login_and_register_forms_need_no_one_signed_in(app_body):
    cond = _branch_rendering(app_body, "RegisterPage")
    assert "!user" in cond, (
        f"the sign-in/sign-up branch renders whoever is signed in: {cond!r}")
    assert re.search(r"onAuthForm\s*&&\s*!user", cond)


def test_the_reset_flow_is_not_cut_off_when_it_signs_in(app_body):
    """ResetPasswordPage calls onLogin, then shows progress and a result. Gating
    it on `!user` would unmount it the moment it signs the person in."""
    cond = _branch_rendering(app_body, "ResetPasswordPage")
    assert "route === '/reset'" in cond
    assert not re.search(r"route === '/reset'\s*&&\s*!user", cond)


def test_a_signed_in_person_on_the_form_is_sent_home_without_a_history_entry(app_body):
    assert "const onAuthForm = route === '/login' || route === '/register';" in app_body
    effect = app_body[app_body.index("if (user && onAuthForm)"):]
    effect = effect[:effect.index("\n")]
    # `replace`, whichever the destination: home, or the invitation that sent
    # them to sign in (invite-link.js). Assigning the hash would leave the form
    # one Back away.
    assert "window.location.replace(" in effect and "'#/'" in effect, (
        "Back must not lead to the form again")
    assert "window.location.hash" not in effect