#!/usr/bin/env python3
"""
Test de sécurité pour les routes de réglages
Vérifie que les valeurs invalides sont correctement rejetées
"""

import requests
import json

# Configuration
API_URL = "http://localhost:3000"
TEST_USER_ID = 1

# Token JWT test (À adapter avec un token valide)
HEADERS = {
    "Content-Type": "application/json",
    "Authorization": "Bearer YOUR_JWT_TOKEN_HERE"
}

def test_invalid_theme():
    """Test que les thèmes invalides sont rejetés"""
    print("\n🧪 Test 1: Vérifier que les thèmes invalides sont rejetés")
    print("-" * 60)
    
    invalid_themes = [
        "xss_attack",
        "'; DROP TABLE users--",
        "malicious",
        "123456789",  # Trop courts
        "a" * 100,   # Trop longs
        "",
        None
    ]
    
    valid_payload = {
        "music": True,
        "sfx": True,
        "haptics": True,
        "theme": "ocean",
        "animationSpeed": "normal",
        "sfxVolume": 0.7,
        "musicVolume": 0.4
    }
    
    for theme in invalid_themes:
        payload = valid_payload.copy()
        payload["theme"] = theme
        
        try:
            response = requests.put(
                f"{API_URL}/settings/{TEST_USER_ID}",
                json=payload,
                headers=HEADERS,
                timeout=5
            )
            
            if response.status_code == 400:
                print(f"✅ Thème '{theme}' correctement rejeté (400)")
            else:
                print(f"❌ FAILLE: Thème '{theme}' accepté (status={response.status_code})")
                print(f"   Response: {response.text}")
        except Exception as e:
            print(f"⚠️  Erreur test: {e}")


def test_invalid_animation_speed():
    """Test que les vitesses d'animation invalides sont rejetées"""
    print("\n🧪 Test 2: Vérifier que les vitesses d'animation invalides sont rejetées")
    print("-" * 60)
    
    invalid_speeds = [
        "super_fast",
        "speed_hack",
        "'; DROP TABLE users--",
        "123",
        "x" * 100,
        ""
    ]
    
    valid_payload = {
        "music": True,
        "sfx": True,
        "haptics": True,
        "theme": "ocean",
        "animationSpeed": "normal",
        "sfxVolume": 0.7,
        "musicVolume": 0.4
    }
    
    for speed in invalid_speeds:
        payload = valid_payload.copy()
        payload["animationSpeed"] = speed
        
        try:
            response = requests.put(
                f"{API_URL}/settings/{TEST_USER_ID}",
                json=payload,
                headers=HEADERS,
                timeout=5
            )
            
            if response.status_code == 400:
                print(f"✅ Vitesse '{speed}' correctement rejetée (400)")
            else:
                print(f"❌ FAILLE: Vitesse '{speed}' acceptée (status={response.status_code})")
                print(f"   Response: {response.text}")
        except Exception as e:
            print(f"⚠️  Erreur test: {e}")


def test_valid_themes():
    """Test que les thèmes valides sont acceptés"""
    print("\n🧪 Test 3: Vérifier que les thèmes valides sont acceptés")
    print("-" * 60)
    
    valid_themes = ["ocean", "sunset", "neon"]
    
    valid_payload = {
        "music": True,
        "sfx": True,
        "haptics": True,
        "theme": "ocean",
        "animationSpeed": "normal",
        "sfxVolume": 0.7,
        "musicVolume": 0.4
    }
    
    for theme in valid_themes:
        payload = valid_payload.copy()
        payload["theme"] = theme
        
        try:
            response = requests.put(
                f"{API_URL}/settings/{TEST_USER_ID}",
                json=payload,
                headers=HEADERS,
                timeout=5
            )
            
            if response.status_code == 200:
                print(f"✅ Thème '{theme}' correctement accepté (200)")
            else:
                print(f"❌ PROBLÈME: Thème '{theme}' rejeté à tort (status={response.status_code})")
                print(f"   Response: {response.text}")
        except Exception as e:
            print(f"⚠️  Erreur test: {e}")


def test_valid_animation_speeds():
    """Test que les vitesses d'animation valides sont acceptées"""
    print("\n🧪 Test 4: Vérifier que les vitesses d'animation valides sont acceptées")
    print("-" * 60)
    
    valid_speeds = ["slow", "normal", "fast"]
    
    valid_payload = {
        "music": True,
        "sfx": True,
        "haptics": True,
        "theme": "ocean",
        "animationSpeed": "normal",
        "sfxVolume": 0.7,
        "musicVolume": 0.4
    }
    
    for speed in valid_speeds:
        payload = valid_payload.copy()
        payload["animationSpeed"] = speed
        
        try:
            response = requests.put(
                f"{API_URL}/settings/{TEST_USER_ID}",
                json=payload,
                headers=HEADERS,
                timeout=5
            )
            
            if response.status_code == 200:
                print(f"✅ Vitesse '{speed}' correctement acceptée (200)")
            else:
                print(f"❌ PROBLÈME: Vitesse '{speed}' rejetée à tort (status={response.status_code})")
                print(f"   Response: {response.text}")
        except Exception as e:
            print(f"⚠️  Erreur test: {e}")


def main():
    print("=" * 60)
    print("🔒 Test de sécurité - Routes de réglages")
    print("=" * 60)
    print(f"API URL: {API_URL}")
    print(f"Test User ID: {TEST_USER_ID}")
    print(f"Statut: {'⚠️ Token JWT à configurer' if 'YOUR_JWT_TOKEN_HERE' in HEADERS['Authorization'] else '✅ Token JWT configuré'}")
    
    if 'YOUR_JWT_TOKEN_HERE' in HEADERS['Authorization']:
        print("\n⚠️ ATTENTION: Mettez à jour le token JWT dans le script avant de lancer les tests!")
        print("Voir ligne: HEADERS['Authorization'] = 'Bearer YOUR_JWT_TOKEN_HERE'")
        return
    
    test_invalid_theme()
    test_invalid_animation_speed()
    test_valid_themes()
    test_valid_animation_speeds()
    
    print("\n" + "=" * 60)
    print("✅ Tests de sécurité terminés")
    print("=" * 60)


if __name__ == "__main__":
    main()