"""First-run setup stores a login and does not print the JWT."""

from verae_mcp_timestamping_server.global_client import GlobalClient
from verae_mcp_timestamping_server.setup_cmd import login_hint, run_setup

from test_global_client import FakeHttp, _auth_http


def test_setup_signup_writes_token_file_without_printing_it(tmp_path, capsys):
    path = tmp_path / "auth.properties"
    http = _auth_http()
    client = GlobalClient("https://api.veraetime.net", http=http, auth_path=path)
    code = run_setup(
        ["--signup", "--username", "newcomer", "--password", "secret-pass"],
        client=client,
    )
    assert code == 0
    text = capsys.readouterr().out
    assert "fresh-token" not in text
    assert "username=admin" in text
    assert "role=admin" in text
    assert f"Wrote {path}" in text
    stored = path.read_text()
    assert "access_token=fresh-token" in stored
    assert path.stat().st_mode & 0o777 == 0o600
    assert any(url.endswith("/auth/signup") for _, url, _, _ in http.calls)
    assert any(url.endswith("/auth/login") for _, url, _, _ in http.calls)


def test_login_hint_only_when_missing(tmp_path):
    empty = GlobalClient("https://api.veraetime.net", http=FakeHttp(), auth_path=tmp_path / "missing.properties")
    assert "uvx verae-mcp-timestamping-server setup" in (login_hint(empty) or "")
    signed = GlobalClient(
        "https://api.veraetime.net",
        token="secret",
        http=FakeHttp(),
        auth_path=tmp_path / "auth.properties",
    )
    assert login_hint(signed) is None