"""
Remote API test script.
Usage:
    python test_endpoints.py                          # uses default remote URL
    python test_endpoints.py https://my-api.com      # override base URL
    python test_endpoints.py https://my-api.com admin admin123
"""
import sys
import json
import requests

# ---------------------------------------------------------------------------
# Configuration — edit these defaults or pass as CLI args
# ---------------------------------------------------------------------------
BASE_URL  = sys.argv[1] if len(sys.argv) > 1 else "https://skld-api.cogneura-apps.com"
USERNAME  = sys.argv[2] if len(sys.argv) > 2 else "admin"
PASSWORD  = sys.argv[3] if len(sys.argv) > 3 else "admin123"
# ---------------------------------------------------------------------------

PASS = "\033[92mPASS\033[0m"
FAIL = "\033[91mFAIL\033[0m"

def check(label, response, expected_status=200):
    ok = response.status_code == expected_status
    status = PASS if ok else FAIL
    print(f"[{status}] {label} — HTTP {response.status_code}")
    if not ok:
        print(f"       {response.text[:300]}")
    return ok

def main():
    print(f"\nTarget: {BASE_URL}\n{'='*60}")

    # 1. Health check
    r = requests.get(f"{BASE_URL}/health", timeout=10)
    check("GET /health", r)

    # 2. Login
    print()
    r = requests.post(
        f"{BASE_URL}/token",
        data={"username": USERNAME, "password": PASSWORD},
        timeout=10,
    )
    if not check("POST /token (login)", r):
        print("Cannot continue without a token.")
        sys.exit(1)
    token = r.json()["access_token"]
    headers = {"Authorization": f"Bearer {token}"}
    print(f"       Token acquired.")

    # 3. /users/me
    print()
    r = requests.get(f"{BASE_URL}/users/me", headers=headers, timeout=10)
    if check("GET /users/me", r):
        me = r.json()
        print(f"       Logged in as: {me.get('username')} (id={me.get('id')})")

    # 4. Topics
    print()
    r = requests.get(f"{BASE_URL}/topics", timeout=10)
    if check("GET /topics", r):
        topics = r.json()
        print(f"       Topics found: {len(topics)}")
        if topics:
            first_topic = topics[0]["id"]
            print(f"       First topic id: {first_topic}")
        else:
            first_topic = None

    # 5. Quizzes for first topic
    if first_topic:
        print()
        r = requests.get(f"{BASE_URL}/topics/{first_topic}/quizzes", timeout=10)
        if check(f"GET /topics/{first_topic}/quizzes", r):
            quizzes = r.json()
            print(f"       Quizzes found: {len(quizzes)}")
            first_quiz = quizzes[0]["id"] if quizzes else None
        else:
            first_quiz = None
    else:
        first_quiz = None

    # 6. Questions for first quiz (includes answer — auth required)
    if first_quiz:
        print()
        r = requests.get(f"{BASE_URL}/quizzes/{first_quiz}/questions", headers=headers, timeout=10)
        if check(f"GET /quizzes/{first_quiz}/questions", r):
            questions = r.json()
            print(f"       Questions found: {len(questions)}")
            if questions and "answer" in questions[0]:
                print(f"       [{PASS}] 'answer' field present (expected for this endpoint)")

    # 7. Random questions — answer must be hidden
    print()
    r = requests.get(f"{BASE_URL}/questions/random?limit=3", timeout=10)
    if check("GET /questions/random?limit=3", r):
        qs = r.json()
        print(f"       Random questions: {len(qs)}")
        if qs:
            if "answer" not in qs[0]:
                print(f"       [{PASS}] 'answer' field correctly hidden")
            else:
                print(f"       [{FAIL}] 'answer' field exposed — security issue!")

    # 8. Log activity
    print()
    r = requests.post(
        f"{BASE_URL}/activity",
        json={"action": "test_run", "details": json.dumps({"source": "test_endpoints.py"})},
        headers=headers,
        timeout=10,
    )
    check("POST /activity", r, expected_status=201)

    # 9. Activity history
    print()
    r = requests.get(f"{BASE_URL}/users/me/activity", headers=headers, timeout=10)
    if check("GET /users/me/activity", r):
        activity = r.json()
        print(f"       Activity records: {len(activity)}")

    print(f"\n{'='*60}\nDone.\n")

if __name__ == "__main__":
    main()