#!/usr/bin/python3
#
# Copyright (C) 2026 Red Hat, Inc.
# SPDX-License-Identifier: LGPL-2.1-or-later

from anacondalib import INSTALLER_VM_MEMORY_MB, VirtInstallMachineCase
from testlib import Error, test_main  # pylint: disable=import-error


class TestRemoteAuth(VirtInstallMachineCase):
    provision = {
        "machine1": {
            "remote_pin": "test1234",
            "memory_mb": INSTALLER_VM_MEMORY_MB,
        },
    }

    def testBasic(self):
        """
        Description:
            Boot with ``inst.webui.remote inst.webui.remote.pin=test1234``
            and verify that PIN authentication is required over HTTPS.

        Expected results:
            - Plain HTTP on port 80 is not reachable
            - The login page is shown over HTTPS
            - Wrong PIN is rejected with an error
            - Correct PIN grants access to the installer
        """
        b = self.browser
        webui_path = "/cockpit/@localhost/anaconda-webui/index.html"

        # HTTP should not be reachable — cockpit-ws is bound to localhost
        # TODO: better to redirect from http to https
        for url_path in [webui_path, "/"]:
            with self.assertRaises(Error) as err:
                b.open(url_path, tls=False)
            self.assertIn("net::ERR_", str(err.exception))
        # Opening at "/" should work (using webui_path should work too, but that's given)
        b.open("/", tls=True)

        # Login page should be visible
        b.wait_visible("#pin-input")

        # Wrong password should be rejected
        b.set_input_text("#pin-input", "wrongpin")
        b.click("button[type=submit]")
        b.wait_in_text(".pf-m-error", "Invalid PIN")

        # Correct password should grant access
        b.set_input_text("#pin-input", "test1234")
        b.click("button[type=submit]")

        # After login redirect, the installer loads at the root path
        b.wait_js_cond(f'window.location.pathname === "{webui_path}"')


if __name__ == "__main__":
    test_main()