#!/usr/bin/env python3
"""
Test script to verify security features are working correctly.
"""

import asyncio

import aiohttp


async def test_cors_headers():
    """Test CORS headers for unknown domains."""
    print("🧪 Testing CORS headers...")

    async with aiohttp.ClientSession() as session:
        # Test with an unknown origin
        headers = {
            "Origin": "https://unknown-game-domain.com",
            "Content-Type": "application/json",
        }

        async with session.options(
            "http://127.0.0.1:8000/items", headers=headers
        ) as response:
            print(f"   OPTIONS /items status: {response.status}")
            cors_headers = {
                "Access-Control-Allow-Origin": response.headers.get(
                    "Access-Control-Allow-Origin"
                ),
                "Access-Control-Allow-Methods": response.headers.get(
                    "Access-Control-Allow-Methods"
                ),
                "Access-Control-Allow-Headers": response.headers.get(
                    "Access-Control-Allow-Headers"
                ),
            }
            print(f"   CORS headers: {cors_headers}")

        # Test actual request
        async with session.get(
            "http://127.0.0.1:8000/items", headers=headers
        ) as response:
            print(f"   GET /items status: {response.status}")
            if response.status == 200:
                print("   ✅ CORS working for unknown domains")
            else:
                print(f"   ❌ CORS failed: {response.status}")


async def test_rate_limiting():
    """Test rate limiting functionality."""
    print("\n🧪 Testing rate limiting...")

    async with aiohttp.ClientSession() as session:
        # Make multiple rapid requests
        results = []
        for i in range(5):
            try:
                async with session.get("http://127.0.0.1:8000/items") as response:
                    results.append(response.status)
                    rate_limit_headers = {
                        "X-RateLimit-Limit": response.headers.get("X-RateLimit-Limit"),
                        "X-RateLimit-Remaining": response.headers.get(
                            "X-RateLimit-Remaining"
                        ),
                    }
                    if i == 0:
                        print(f"   Rate limit headers: {rate_limit_headers}")
            except Exception as e:
                print(f"   Request {i+1} failed: {e}")

        if all(status == 200 for status in results):
            print(f"   ✅ Made {len(results)} requests successfully")
        else:
            print(f"   ⚠️  Some requests failed: {results}")


async def test_security_headers():
    """Test security headers."""
    print("\n🧪 Testing security headers...")

    async with aiohttp.ClientSession() as session:
        async with session.get("http://127.0.0.1:8000/items") as response:
            security_headers = {
                "X-Content-Type-Options": response.headers.get(
                    "X-Content-Type-Options"
                ),
                "X-Frame-Options": response.headers.get("X-Frame-Options"),
                "X-XSS-Protection": response.headers.get("X-XSS-Protection"),
                "Referrer-Policy": response.headers.get("Referrer-Policy"),
            }
            print(f"   Security headers: {security_headers}")

            if all(v for v in security_headers.values()):
                print("   ✅ All security headers present")
            else:
                print("   ⚠️  Some security headers missing")


async def test_api_documentation():
    """Test API documentation accessibility."""
    print("\n🧪 Testing API documentation...")

    async with aiohttp.ClientSession() as session:
        async with session.get("http://127.0.0.1:8000/docs") as response:
            if response.status == 200:
                print("   ✅ OpenAPI docs accessible")
            else:
                print(f"   ❌ OpenAPI docs failed: {response.status}")

        async with session.get("http://127.0.0.1:8000/openapi.json") as response:
            if response.status == 200:
                print("   ✅ OpenAPI schema accessible")
            else:
                print(f"   ❌ OpenAPI schema failed: {response.status}")


async def main():
    """Run all tests."""
    print("🚀 Testing Random Access API Security Features\n")

    try:
        await test_cors_headers()
        await test_rate_limiting()
        await test_security_headers()
        await test_api_documentation()

        print("\n✅ All security tests completed!")
        print("\n🎯 Summary:")
        print("   • CORS configured to allow unknown game domains")
        print("   • Rate limiting active")
        print("   • Security headers applied")
        print("   • API documentation accessible")
        print("   • Ready for web-based game integration!")

    except Exception as e:
        print(f"\n❌ Test failed with error: {e}")


if __name__ == "__main__":
    asyncio.run(main())