import pytest
from httpx import ASGITransport, AsyncClient

from app.main import app


@pytest.mark.asyncio
async def test_login_cookie_secure_only_over_https(client):
    await client.post("/auth/register", json={"username": "schemer", "password": "spookyspooky"})

    https_login = await client.post(
        "/auth/login", json={"username": "schemer", "password": "spookyspooky"}
    )
    assert "secure" in https_login.headers["set-cookie"].lower()

    # Plain-http (LAN) access: a Secure cookie would be dropped by the
    # browser and silently break the séance socket.
    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as http_client:
        http_login = await http_client.post(
            "/auth/login", json={"username": "schemer", "password": "spookyspooky"}
        )
    cookie = http_login.headers["set-cookie"].lower()
    assert "qm_session=" in cookie
    assert "secure" not in cookie