import os,tempfile,re
fd,path=tempfile.mkstemp(suffix='.sqlite3');os.close(fd);os.unlink(path)
os.environ['ICTW_DB']=path
os.environ['ICTW_BOOTSTRAP_ADMIN_TOKEN']='test-admin'
from fastapi.testclient import TestClient
from app import app
with TestClient(app,base_url='https://demo.example') as c:
    res=c.post('/admin/clients',headers={'x-admin-token':'test-admin'},json={'name':'Shop One','website':'https://shop.example','personal_number':'01700000000','merchant_number':'01800000000'})
    assert res.status_code==200,res.text
    key=res.json()['api_key']
    res=c.post('/merchant/login',data={'api_key':key},follow_redirects=False)
    assert res.status_code==303,res.text
    dash=c.get('/merchant/dashboard')
    assert dash.status_code==200,dash.text
    csrf=re.search('name="csrf" value="([^"]+)"',dash.text).group(1)
    assert c.post('/merchant/create-link',data={'csrf':'wrong','order_id':'TX-1','amount':'1000','mode':'personal'}).status_code==403
    linkpage=c.post('/merchant/create-link',data={'csrf':csrf,'order_id':'TX-1','amount':'1000','mode':'personal'})
    assert linkpage.status_code==200,linkpage.text
    link=re.search(r'http://127\.0\.0\.1:8000/pay/[\w-]+',linkpage.text).group(0)
    checkout=c.get(link.replace('http://127.0.0.1:8000',''))
    assert checkout.status_code==200
    assert 'Charge' not in checkout.text and 'fee' not in checkout.text.lower()
    assert 'TX-1' in c.get('/merchant/dashboard').text
    assert c.post('/merchant/create-link',data={'csrf':csrf,'order_id':'TX-1','amount':'1000','mode':'personal'}).status_code==409
    from app import db
    with db() as conn:
        pid=conn.execute("SELECT id FROM orders WHERE merchant_order_id='TX-1'").fetchone()['id']
    r=c.post('/admin/decisions',headers={'x-admin-token':'test-admin'},json={'payment_id':pid,'status':'verified_success'})
    assert r.status_code==200,r.text
    dash2=c.get('/merchant/dashboard')
    assert '23.00' in dash2.text,dash2.text
    r=c.post('/merchant/logout',data={'csrf':csrf},follow_redirects=False)
    assert r.status_code==303
    assert c.get('/merchant/dashboard').status_code==401
print('PASS merchant login, CSRF, create/copy URL, isolation, charge dashboard, payer fee hidden, logout')
os.unlink(path)