def test_root_returns_status(client):
    response = client.get("/")
    assert response.status_code == 200
    assert response.json()["status"] == "Smart IDS API is running"


def test_health_reports_connected_when_db_ok(client, mock_db):
    response = client.get("/api/health")
    assert response.status_code == 200
    assert response.json()["database"] == "connected"


def test_login_with_correct_credentials(client):
    response = client.post("/api/login", json={
        "username": "admin",
        "password": "IDPS@2026"
    })
    assert response.status_code == 200
    assert "token" in response.json()


def test_login_with_wrong_password_rejected(client):
    response = client.post("/api/login", json={
        "username": "admin",
        "password": "wrong-password"
    })
    assert response.status_code == 401


def test_protected_endpoint_without_token_rejected(client):
    response = client.post("/api/block-ip", json={"ip_address": "1.2.3.4"})
    assert response.status_code == 401


def test_protected_endpoint_with_valid_token(client, mock_db, auth_token):
    response = client.post(
        "/api/block-ip",
        json={"ip_address": "1.2.3.4"},
        headers={"Authorization": f"Bearer {auth_token}"}
    )
    assert response.status_code == 200
    assert response.json()["status"] == "blocked"
