"""Tests for the password branch of the ``settings_form.html`` macro.

Pins the contract that:
- The saved password value never enters the rendered HTML (no
  ``value="sk-..."`` attribute leak via View Source on the settings page).
- The configured/not-configured state is communicated via the
  ``placeholder`` attribute, not the value.
- ``autocomplete="new-password"`` is set so browser password managers
  don't offer to save the empty placeholder, and don't re-fill it on
  return visits.

The macro is rendered via a standalone Jinja2 environment pointing at
the project's ``templates/`` directory — no Flask app is required.
"""
# allow: no-sut-import — renders the real settings_form.html macro via
# Jinja2; the SUT here is a template file, not an importable Python module.

from pathlib import Path

import pytest
from jinja2 import Environment, FileSystemLoader, select_autoescape


REPO_ROOT = Path(__file__).resolve().parents[3]
TEMPLATES_DIR = REPO_ROOT / "src" / "local_deep_research" / "web" / "templates"


@pytest.fixture
def env():
    """Jinja2 environment matching Flask's defaults for autoescape."""
    return Environment(
        loader=FileSystemLoader(str(TEMPLATES_DIR)),
        autoescape=select_autoescape(["html", "xml"]),
    )


def _render_password_setting(env, value):
    """Render the macro with a password-typed setting and return the HTML."""
    tmpl = env.from_string(
        "{% from 'components/settings_form.html' import render_setting %}"
        "{{ render_setting(setting) }}"
    )
    return tmpl.render(
        setting={
            "key": "llm.openai.api_key",
            "name": "OpenAI API Key",
            "description": "Authentication key for OpenAI",
            "ui_element": "password",
            "value": value,
            "editable": True,
        }
    )


def test_password_input_renders_empty_value(env):
    """The plaintext secret must not appear in the value attribute."""
    secret = "sk-real-secret-12345"
    html = _render_password_setting(env, secret)

    # The input is rendered with value=""
    assert 'value=""' in html
    # Belt-and-braces: the secret string is nowhere in the rendered HTML
    assert secret not in html


def test_configured_state_shows_saved_placeholder(env):
    """A non-empty saved value reads as 'saved — type to change'."""
    html = _render_password_setting(env, "sk-something-set")
    assert "saved" in html.lower()
    assert "type to change" in html.lower()


def test_not_configured_state_shows_placeholder(env):
    """An empty/None saved value reads as 'not configured'."""
    html_empty = _render_password_setting(env, "")
    html_none = _render_password_setting(env, None)
    assert "not configured" in html_empty.lower()
    assert "not configured" in html_none.lower()


def test_autocomplete_new_password_attribute_set(env):
    """Without autocomplete='new-password' some browsers will still offer
    to autofill cached values; this is the standard cross-browser opt-out."""
    html = _render_password_setting(env, "sk-something")
    assert 'autocomplete="new-password"' in html


def test_password_input_type_remains_password(env):
    """Sanity — the input is still type=password (we didn't accidentally
    flip it to text while reworking the value/placeholder logic)."""
    html = _render_password_setting(env, "sk-x")
    assert 'type="password"' in html
