def test_admin_login_and_delete(client):
    token = client.post("/api/admin/login", json={"password": "changeme"}).json()["token"]
    headers = {"Authorization": f"Bearer {token}"}
    slug = client.post("/api/items", json={"body": "bye"}).json()["slug"]
    items = client.get("/api/admin/items", headers=headers).json()["items"]
    item_id = next(i["id"] for i in items if i["slug"] == slug)
    assert client.delete(f"/api/admin/items/{item_id}", headers=headers).status_code == 200
    assert client.get(f"/api/items/{slug}").status_code == 404


def test_admin_login_rejects_bad_password(client):
    r = client.post("/api/admin/login", json={"password": "wrong"})
    assert r.status_code == 401


def test_admin_requires_bearer(client):
    assert client.get("/api/admin/items").status_code == 401
    assert client.get("/api/admin/items", headers={"Authorization": "Bearer nope"}).status_code == 401


def test_admin_ban_and_unban(client):
    token = client.post("/api/admin/login", json={"password": "changeme"}).json()["token"]
    headers = {"Authorization": f"Bearer {token}"}

    r = client.post("/api/admin/bans", headers=headers, json={"ip": "1.2.3.4", "reason": "spam"})
    assert r.status_code == 200
    bans = client.get("/api/admin/bans", headers=headers).json()["bans"]
    assert any(b["ip"] == "1.2.3.4" and b.get("reason") == "spam" for b in bans)

    assert client.delete("/api/admin/bans/1.2.3.4", headers=headers).status_code == 200
    bans_after = client.get("/api/admin/bans", headers=headers).json()["bans"]
    assert all(b["ip"] != "1.2.3.4" for b in bans_after)