*** Settings ***
Documentation       Authentication API tests for Aniworld.
...                 Covers setup, login, logout, status, rate limiting, and JWT validation.
...                 NOTE: Suite setup already configures the app, so tests verify "already configured" behavior.

Resource            ${CURDIR}/../resources/common.resource
Resource            ${CURDIR}/../resources/api_keywords.resource

Test Setup          Create Anonymous Session
Test Teardown       Delete All Sessions

*** Test Cases ***
# ---------------------------------------------------------------------------
# Setup
# ---------------------------------------------------------------------------
Setup Returns 400 When Already Configured
    [Documentation]    Verify that setup returns 400 when app is already configured.
    ${resp}=    POST Auth Setup    ${SETUP_PASSWORD}    400
    Response Should Have Status    ${resp}    400

Setup Rejects Weak Password
    [Documentation]    Verify that weak passwords are rejected during setup.
    ${resp}=    POST Auth Setup    weak    422
    Response Should Have Status    ${resp}    422

Setup Rejects Duplicate
    [Documentation]    Verify that setup cannot be performed twice with different passwords.
    ${resp}=    POST Auth Setup    AnotherPass123!    400
    Response Should Have Status    ${resp}    400

# ---------------------------------------------------------------------------
# Login
# ---------------------------------------------------------------------------
Login With Valid Password
    [Documentation]    Log in with the correct master password and receive a JWT token.
    ${resp}=    POST Auth Login    ${SETUP_PASSWORD}    200
    Response Should Have Status    ${resp}    200
    ${token}=    Get JSON Value    ${resp}    $.access_token
    Should Not Be Empty    ${token}

Login With Invalid Password
    [Documentation]    Log in with an incorrect password and receive 401.
    ${resp}=    POST Auth Login    WrongPass123!    401
    Response Should Have Status    ${resp}    401

Login Rate Limiting
    [Documentation]    Verify that repeated failed login attempts trigger rate limiting.
    FOR    ${i}    IN RANGE    6
        ${resp}=    POST Auth Login    WrongPass123!    expected_status=ANY
    END
    ${resp}=    POST Auth Login    WrongPass123!    expected_status=ANY
    Should Be True    ${resp.status_code} >= 429 or ${resp.status_code} == 401

# ---------------------------------------------------------------------------
# Auth Status
# ---------------------------------------------------------------------------
Auth Status Configured Unauthenticated
    [Documentation]    Check auth status after setup but without a token.
    ${resp}=    GET Auth Status    200
    Response Should Have Status    ${resp}    200
    ${configured}=    Get JSON Value    ${resp}    $.configured
    Should Be Equal As Strings    ${configured}    True
    ${authenticated}=    Get JSON Value    ${resp}    $.authenticated
    Should Be Equal As Strings    ${authenticated}    False

Auth Status Authenticated
    [Documentation]    Check auth status with a valid Bearer token.
    ${token}=    Login And Get Token
    ${headers}=    Create Dictionary    Authorization=Bearer ${token}
    Create Session    authed    ${BASE_URL}    headers=${headers}
    ${resp}=    GET On Session    authed    /api/auth/status    expected_status=200
    Response Should Have Status    ${resp}    200
    ${authenticated}=    Get JSON Value    ${resp}    $.authenticated
    Should Be Equal As Strings    ${authenticated}    True

# ---------------------------------------------------------------------------
# Logout
# ---------------------------------------------------------------------------
Logout
    [Documentation]    Log out and verify the token is invalidated.
    ${token}=    Login And Get Token
    ${headers}=    Create Dictionary    Authorization=Bearer ${token}
    Create Session    authed    ${BASE_URL}    headers=${headers}
    ${resp}=    POST On Session    authed    /api/auth/logout    expected_status=200
    Response Should Have Status    ${resp}    200

# ---------------------------------------------------------------------------
# Protected Endpoints
# ---------------------------------------------------------------------------
Protected Endpoint Without Auth
    [Documentation]    Verify that protected endpoints reject unauthenticated requests.
    ${resp}=    GET On Session    anon    /api/anime/    expected_status=401
    Response Should Have Status    ${resp}    401

Protected Endpoint With Auth
    [Documentation]    Verify that protected endpoints accept authenticated requests.
    ${token}=    Login And Get Token
    ${headers}=    Create Dictionary    Authorization=Bearer ${token}
    Create Session    authed    ${BASE_URL}    headers=${headers}
    ${resp}=    GET On Session    authed    /api/anime/    expected_status=200
    Response Should Have Status    ${resp}    200