test_requirements.py

"""
Comprehensive test suite to validate all requirements from README_tanishk.md
Tests all phases: Models, Auth, Company Management, Master Data, and Tracking

Run with: pytest test_requirements.py -v
"""

import pytest
import asyncio
from httpx import AsyncClient, ASGITransport
from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession, async_sessionmaker
from sqlalchemy import select, inspect
from app.main import app
from app.database import Base, get_db
from app.models import (
    Company, User, Country, Currency, Airport, Charge, ChargeAlias,
    Quote, QuoteCharge, Invoice, InvoiceCharge, Anomaly, TrackingEvent
)
from app.auth.security import get_password_hash
from datetime import datetime
import os

# Test database URL (use in-memory SQLite for testing)
TEST_DATABASE_URL = "sqlite+aiosqlite:///:memory:"

# Global test engine and session
test_engine = None
TestSessionLocal = None


@pytest.fixture(scope="session")
def event_loop():
    """Create an event loop for the test session"""
    loop = asyncio.get_event_loop_policy().new_event_loop()
    yield loop
    loop.close()


@pytest.fixture(scope="session")
async def setup_database():
    """Setup test database and create all tables"""
    global test_engine, TestSessionLocal
    
    test_engine = create_async_engine(
        TEST_DATABASE_URL,
        echo=False,
        connect_args={"check_same_thread": False}
    )
    
    TestSessionLocal = async_sessionmaker(
        test_engine,
        class_=AsyncSession,
        expire_on_commit=False
    )
    
    # Create all tables
    async with test_engine.begin() as conn:
        await conn.run_sync(Base.metadata.create_all)
    
    yield
    
    # Cleanup
    async with test_engine.begin() as conn:
        await conn.run_sync(Base.metadata.drop_all)
    
    await test_engine.dispose()


@pytest.fixture
async def db_session(setup_database):
    """Provide a clean database session for each test"""
    async with TestSessionLocal() as session:
        yield session
        await session.rollback()


@pytest.fixture
async def client(db_session):
    """Provide an async HTTP client with database override"""
    async def override_get_db():
        yield db_session
    
    app.dependency_overrides[get_db] = override_get_db
    
    transport = ASGITransport(app=app)
    async with AsyncClient(transport=transport, base_url="http://test") as ac:
        yield ac
    
    app.dependency_overrides.clear()


@pytest.fixture
async def seed_basic_data(db_session):
    """Seed basic master data for tests"""
    # Create countries
    country1 = Country(name="United States", short_name="US", is_active=True)
    country2 = Country(name="United Kingdom", short_name="UK", is_active=True)
    db_session.add_all([country1, country2])
    await db_session.flush()
    
    # Create currencies
    currency1 = Currency(name="US Dollar", short_name="USD", is_active=True)
    currency2 = Currency(name="Euro", short_name="EUR", is_active=True)
    db_session.add_all([currency1, currency2])
    await db_session.flush()
    
    # Create airports
    airport1 = Airport(name="John F Kennedy International", iata_code="JFK", country_id=country1.id, is_active=True)
    airport2 = Airport(name="Heathrow", iata_code="LHR", country_id=country2.id, is_active=True)
    db_session.add_all([airport1, airport2])
    await db_session.flush()
    
    # Create companies
    client_company = Company(
        name="Test Client Corp",
        short_name="TCC",
        type="client",
        address="123 Test St",
        city="New York",
        country="USA",
        is_active=True
    )
    forwarder_company = Company(
        name="Test Forwarder Inc",
        short_name="TFI",
        type="forwarder",
        address="456 Freight Ave",
        city="London",
        country="UK",
        is_active=True
    )
    db_session.add_all([client_company, forwarder_company])
    await db_session.flush()
    
    # Create users
    admin_user = User(
        company_id=client_company.id,
        name="Admin User",
        email="admin@test.com",
        password_hash=get_password_hash("admin123"),
        is_admin=True,
        is_active=True
    )
    regular_user = User(
        company_id=client_company.id,
        name="Regular User",
        email="user@test.com",
        password_hash=get_password_hash("user123"),
        is_admin=False,
        is_active=True
    )
    db_session.add_all([admin_user, regular_user])
    await db_session.flush()
    
    await db_session.commit()
    
    return {
        "countries": [country1, country2],
        "currencies": [currency1, currency2],
        "airports": [airport1, airport2],
        "companies": [client_company, forwarder_company],
        "users": [admin_user, regular_user]
    }


# ============================================================================
# PHASE 1: DATABASE MODELS & MIGRATIONS TESTS
# ============================================================================

class TestPhase1DatabaseModels:
    """Test Task 1.1 - All SQLAlchemy ORM models exist with correct fields"""
    
    @pytest.mark.asyncio
    async def test_all_tables_exist(self, setup_database):
        """Verify all required tables are created"""
        async with test_engine.connect() as conn:
            def check_tables(connection):
                inspector = inspect(connection)
                tables = inspector.get_table_names()
                return tables
            
            tables = await conn.run_sync(check_tables)
            
            required_tables = [
                "companies", "users", "countries", "currencies", "airports",
                "charges", "charge_aliases", "quotes", "quote_charges",
                "invoices", "invoice_charges", "anomalies", "tracking_events"
            ]
            
            for table in required_tables:
                assert table in tables, f"Table '{table}' is missing"
    
    @pytest.mark.asyncio
    async def test_company_model_fields(self, db_session):
        """Verify Company model has all required fields"""
        company = Company(
            name="Test Company",
            short_name="TC",
            type="client",
            address="123 Test St",
            city="Test City",
            country="Test Country",
            is_active=True
        )
        db_session.add(company)
        await db_session.commit()
        
        result = await db_session.execute(select(Company).where(Company.name == "Test Company"))
        saved_company = result.scalar_one()
        
        assert saved_company.id is not None
        assert saved_company.name == "Test Company"
        assert saved_company.short_name == "TC"
        assert saved_company.type == "client"
        assert saved_company.is_active is True
    
    @pytest.mark.asyncio
    async def test_user_model_fields(self, db_session, seed_basic_data):
        """Verify User model has all required fields"""
        company = seed_basic_data["companies"][0]
        
        user = User(
            company_id=company.id,
            name="Test User",
            email="test@example.com",
            password_hash="hashed_password",
            is_admin=False,
            is_active=True
        )
        db_session.add(user)
        await db_session.commit()
        
        result = await db_session.execute(select(User).where(User.email == "test@example.com"))
        saved_user = result.scalar_one()
        
        assert saved_user.id is not None
        assert saved_user.company_id == company.id
        assert saved_user.name == "Test User"
        assert saved_user.is_admin is False
    
    @pytest.mark.asyncio
    async def test_charge_and_alias_relationship(self, db_session, seed_basic_data):
        """Verify Charge and ChargeAlias models with cascade delete"""
        company = seed_basic_data["companies"][0]
        
        charge = Charge(
            company_id=company.id,
            name="Bunker Adjustment Factor",
            short_name="BAF",
            is_active=True
        )
        db_session.add(charge)
        await db_session.flush()
        
        alias1 = ChargeAlias(charge_id=charge.id, alias="Fuel Surcharge")
        alias2 = ChargeAlias(charge_id=charge.id, alias="FSC")
        db_session.add_all([alias1, alias2])
        await db_session.commit()
        
        # Verify aliases are saved
        result = await db_session.execute(select(ChargeAlias).where(ChargeAlias.charge_id == charge.id))
        aliases = result.scalars().all()
        assert len(aliases) == 2
        
        # Test cascade delete
        await db_session.delete(charge)
        await db_session.commit()
        
        result = await db_session.execute(select(ChargeAlias).where(ChargeAlias.charge_id == charge.id))
        aliases_after_delete = result.scalars().all()
        assert len(aliases_after_delete) == 0
    
    @pytest.mark.asyncio
    async def test_quote_model_with_charges(self, db_session, seed_basic_data):
        """Verify Quote and QuoteCharge models"""
        companies = seed_basic_data["companies"]
        airports = seed_basic_data["airports"]
        currencies = seed_basic_data["currencies"]
        
        quote = Quote(
            forwarder_id=companies[1].id,
            buyer_id=companies[0].id,
            quote_ref="Q-2024-001",
            origin_airport_id=airports[0].id,
            destination_airport_id=airports[1].id,
            tracking_number="TRK123456",
            gross_weight=100.5,
            volumetric_weight=95.0,
            chargeable_weight=100.5,
            currency_id=currencies[0].id,
            status="SUBMITTED"
        )
        db_session.add(quote)
        await db_session.flush()
        
        quote_charge = QuoteCharge(
            quote_id=quote.id,
            raw_charge_name="Fuel Surcharge",
            mapping_tier="DICTIONARY",
            rate=2.5,
            basis="PER_KG",
            qty=100.5,
            amount=251.25
        )
        db_session.add(quote_charge)
        await db_session.commit()
        
        result = await db_session.execute(select(Quote).where(Quote.tracking_number == "TRK123456"))
        saved_quote = result.scalar_one()
        assert saved_quote.status == "SUBMITTED"
        assert len(saved_quote.charges) == 1


# ============================================================================
# PHASE 2: AUTH & USER MANAGEMENT TESTS
# ============================================================================

class TestPhase2Auth:
    """Test Task 2.1, 2.2, 2.3 - Auth and User Management"""
    
    @pytest.mark.asyncio
    async def test_login_endpoint_success(self, client, seed_basic_data):
        """Test POST /auth/login with valid credentials"""
        response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        
        assert response.status_code == 200
        data = response.json()
        assert "access_token" in data
        assert data["token_type"] == "bearer"
        assert "user" in data
        assert data["user"]["email"] == "admin@test.com"
    
    @pytest.mark.asyncio
    async def test_login_endpoint_invalid_credentials(self, client, seed_basic_data):
        """Test POST /auth/login with invalid credentials"""
        response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "wrongpassword"}
        )
        
        assert response.status_code == 401
    
    @pytest.mark.asyncio
    async def test_protected_endpoint_without_token(self, client, seed_basic_data):
        """Test accessing protected endpoint without token"""
        response = await client.get("/companies")
        assert response.status_code == 401
    
    @pytest.mark.asyncio
    async def test_protected_endpoint_with_token(self, client, seed_basic_data):
        """Test accessing protected endpoint with valid token"""
        # Login first
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        # Access protected endpoint
        response = await client.get(
            "/companies",
            headers={"Authorization": f"Bearer {token}"}
        )
        assert response.status_code == 200


# ============================================================================
# PHASE 3: MASTER DATA TESTS
# ============================================================================

class TestPhase3MasterData:
    """Test Task 3.1, 3.2 - Master Data CRUD"""
    
    @pytest.mark.asyncio
    async def test_get_countries(self, client, seed_basic_data):
        """Test GET /masters/countries"""
        # Login first
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        response = await client.get(
            "/masters/countries",
            headers={"Authorization": f"Bearer {token}"}
        )
        
        assert response.status_code == 200
        data = response.json()
        assert len(data) >= 2
    
    @pytest.mark.asyncio
    async def test_get_currencies(self, client, seed_basic_data):
        """Test GET /masters/currencies"""
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        response = await client.get(
            "/masters/currencies",
            headers={"Authorization": f"Bearer {token}"}
        )
        
        assert response.status_code == 200
        data = response.json()
        assert len(data) >= 2
    
    @pytest.mark.asyncio
    async def test_get_airports(self, client, seed_basic_data):
        """Test GET /masters/airports"""
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        response = await client.get(
            "/masters/airports",
            headers={"Authorization": f"Bearer {token}"}
        )
        
        assert response.status_code == 200
        data = response.json()
        assert len(data) >= 2
    
    @pytest.mark.asyncio
    async def test_charge_master_scoping(self, client, db_session, seed_basic_data):
        """Test that charges are scoped to company_id"""
        companies = seed_basic_data["companies"]
        
        # Create charges for company 1
        charge1 = Charge(
            company_id=companies[0].id,
            name="Company 1 Charge",
            short_name="C1C",
            is_active=True
        )
        db_session.add(charge1)
        
        # Create charges for company 2
        charge2 = Charge(
            company_id=companies[1].id,
            name="Company 2 Charge",
            short_name="C2C",
            is_active=True
        )
        db_session.add(charge2)
        await db_session.commit()
        
        # Login as user from company 1
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        # Get charges - should only see company 1's charges
        response = await client.get(
            "/masters/charges",
            headers={"Authorization": f"Bearer {token}"}
        )
        
        assert response.status_code == 200
        data = response.json()
        
        # Verify only company 1's charges are returned
        charge_names = [charge["name"] for charge in data]
        assert "Company 1 Charge" in charge_names
        assert "Company 2 Charge" not in charge_names
    
    @pytest.mark.asyncio
    async def test_create_charge_with_aliases(self, client, seed_basic_data):
        """Test POST /masters/charges with aliases"""
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        response = await client.post(
            "/masters/charges",
            headers={"Authorization": f"Bearer {token}"},
            json={
                "name": "Bunker Adjustment Factor",
                "short_name": "BAF",
                "company_id": seed_basic_data["companies"][0].id,
                "aliases": ["Fuel Surcharge", "FSC", "Bunker Charge"]
            }
        )
        
        assert response.status_code == 200
        data = response.json()
        assert data["name"] == "Bunker Adjustment Factor"
        assert len(data["aliases"]) == 3


# ============================================================================
# PHASE 4: TRACKING TESTS
# ============================================================================

class TestPhase4Tracking:
    """Test Task 4.1, 4.2 - Tracking functionality"""
    
    @pytest.mark.asyncio
    async def test_get_tracking_empty(self, client, seed_basic_data):
        """Test GET /tracking returns empty list when no shipments"""
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        response = await client.get(
            "/tracking",
            headers={"Authorization": f"Bearer {token}"}
        )
        
        assert response.status_code == 200
        data = response.json()
        assert isinstance(data, list)
    
    @pytest.mark.asyncio
    async def test_get_shipment_events(self, client, db_session, seed_basic_data):
        """Test GET /tracking/{quote_id}/events"""
        companies = seed_basic_data["companies"]
        airports = seed_basic_data["airports"]
        currencies = seed_basic_data["currencies"]
        
        # Create a quote
        quote = Quote(
            forwarder_id=companies[1].id,
            buyer_id=companies[0].id,
            tracking_number="TRK999",
            origin_airport_id=airports[0].id,
            destination_airport_id=airports[1].id,
            gross_weight=100,
            volumetric_weight=100,
            chargeable_weight=100,
            currency_id=currencies[0].id,
            status="SUBMITTED"
        )
        db_session.add(quote)
        await db_session.flush()
        
        # Create tracking events
        event1 = TrackingEvent(
            quote_id=quote.id,
            event_time=datetime.utcnow(),
            location="JFK",
            status="PICKED_UP",
            description="Shipment picked up"
        )
        event2 = TrackingEvent(
            quote_id=quote.id,
            event_time=datetime.utcnow(),
            location="LHR",
            status="IN_TRANSIT",
            description="In transit"
        )
        db_session.add_all([event1, event2])
        await db_session.commit()
        
        # Login and get events
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        response = await client.get(
            f"/tracking/{quote.id}/events",
            headers={"Authorization": f"Bearer {token}"}
        )
        
        assert response.status_code == 200
        data = response.json()
        assert len(data) >= 2


# ============================================================================
# PHASE 5: APP BOOTSTRAP TESTS
# ============================================================================

class TestPhase5AppBootstrap:
    """Test Task 5.1 - App bootstrap and health check"""
    
    @pytest.mark.asyncio
    async def test_health_endpoint(self, client):
        """Test GET /health"""
        response = await client.get("/health")
        assert response.status_code == 200
        assert response.json() == {"status": "ok"}
    
    @pytest.mark.asyncio
    async def test_cors_headers(self, client):
        """Test CORS middleware is configured"""
        response = await client.options(
            "/health",
            headers={
                "Origin": "http://localhost:5173",
                "Access-Control-Request-Method": "GET"
            }
        )
        # CORS should allow the request
        assert response.status_code in [200, 204]


# ============================================================================
# ACCEPTANCE CRITERIA TESTS
# ============================================================================

class TestAcceptanceCriteria:
    """Test all acceptance criteria from README"""
    
    @pytest.mark.asyncio
    async def test_jwt_token_structure(self, client, seed_basic_data):
        """Verify JWT token contains required fields"""
        response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        
        assert response.status_code == 200
        data = response.json()
        assert "access_token" in data
        assert data["token_type"] == "bearer"
        
        # Token should be a valid JWT (3 parts separated by dots)
        token_parts = data["access_token"].split(".")
        assert len(token_parts) == 3
    
    @pytest.mark.asyncio
    async def test_company_scoped_charges(self, client, db_session, seed_basic_data):
        """Verify charges are scoped to company - acceptance criteria"""
        # This is a critical acceptance criterion
        companies = seed_basic_data["companies"]
        
        # Create charges for different companies
        charge1 = Charge(company_id=companies[0].id, name="Charge A", short_name="CA", is_active=True)
        charge2 = Charge(company_id=companies[1].id, name="Charge B", short_name="CB", is_active=True)
        db_session.add_all([charge1, charge2])
        await db_session.commit()
        
        # Login as company 1 user
        login_response = await client.post(
            "/auth/login",
            json={"email": "admin@test.com", "password": "admin123"}
        )
        token = login_response.json()["access_token"]
        
        # Get charges
        response = await client.get(
            "/masters/charges",
            headers={"Authorization": f"Bearer {token}"}
        )
        
        assert response.status_code == 200
        charges = response.json()
        
        # Should only see company 1's charges
        for charge in charges:
            assert charge["company_id"] == companies[0].id
    
    @pytest.mark.asyncio
    async def test_non_admin_cannot_create_company(self, client, seed_basic_data):
        """Verify non-admin users get 403 when creating companies"""
        # Login as regular user (not admin)
        login_response = await client.post(
            "/auth/login",
            json={"email": "user@test.com", "password": "user123"}
        )
        token = login_response.json()["access_token"]
        
        # Try to create a company
        response = await client.post(
            "/companies",
            headers={"Authorization": f"Bearer {token}"},
            json={
                "name": "New Company",
                "short_name": "NC",
                "type": "client"
            }
        )
        
        # Should be forbidden
        assert response.status_code == 403


# ============================================================================
# SUMMARY TEST
# ============================================================================

class TestRequirementsSummary:
    """High-level summary test to verify all major components"""
    
    @pytest.mark.asyncio
    async def test_all_models_exist(self, setup_database):
        """Verify all 13 models are defined"""
        models = [
            Company, User, Country, Currency, Airport,
            Charge, ChargeAlias, Quote, QuoteCharge,
            Invoice, InvoiceCharge, Anomaly, TrackingEvent
        ]
        
        for model in models:
            assert hasattr(model, "__tablename__"), f"Model {model.__name__} missing __tablename__"
    
    @pytest.mark.asyncio
    async def test_all_endpoints_registered(self, client):
        """Verify all required endpoints are accessible"""
        # Health check
        response = await client.get("/health")
        assert response.status_code == 200
        
        # Auth endpoint (should return 422 for missing body, not 404)
        response = await client.post("/auth/login")
        assert response.status_code != 404


if __name__ == "__main__":
    pytest.main([__file__, "-v", "--tb=short"])