import os
import unittest

os.environ.setdefault("DATABASE_URL", "sqlite://")
os.environ.setdefault("APP_ENCRYPTION_KEY", "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=")

from sqlalchemy import create_engine
from sqlalchemy.orm import sessionmaker

from web.backend.database import Base
from web.backend.models import Account, User
from web.backend.routers.accounts import list_accounts


class AccountSensitiveFieldsTests(unittest.TestCase):
    def setUp(self):
        self.engine = create_engine("sqlite://")
        Base.metadata.create_all(self.engine)
        self.session = sessionmaker(bind=self.engine)()
        self.admin = User(username="admin", password_hash="hash", role="super_admin")
        self.session.add(self.admin)
        self.session.add(Account(
            username="account",
            password="account-password",
            email="account@example.com",
            email_password="email-password",
        ))
        self.session.commit()

    def tearDown(self):
        self.session.close()
        Base.metadata.drop_all(self.engine)
        self.engine.dispose()

    def test_sensitive_fields_are_hidden_by_default_even_for_admin(self):
        result = list_accounts(
            assigned_only=False,
            tag=None,
            has_cookie=False,
            search="",
            page=1,
            page_size=20,
            include_sensitive=False,
            db=self.session,
            current=self.admin,
        )

        item = result["items"][0]
        self.assertIsNone(item.password)
        self.assertIsNone(item.email)
        self.assertIsNone(item.email_password)

    def test_admin_can_explicitly_request_sensitive_fields(self):
        result = list_accounts(
            assigned_only=False,
            tag=None,
            has_cookie=False,
            search="",
            page=1,
            page_size=20,
            include_sensitive=True,
            db=self.session,
            current=self.admin,
        )

        item = result["items"][0]
        self.assertEqual(item.password, "account-password")
        self.assertEqual(item.email, "account@example.com")
        self.assertEqual(item.email_password, "email-password")


if __name__ == "__main__":
    unittest.main()