from django.contrib.auth import get_user_model
from django.test import Client, TestCase
from django.urls import reverse


class CsrfProtectionTests(TestCase):
    def setUp(self):
        self.client = Client(enforce_csrf_checks=True)

        self.user = get_user_model().objects.create_user(
            username="csrf-test-user",
            password="test-password-123",
        )

        self.client.force_login(self.user)

    def test_post_without_csrf_token_is_rejected(self):
        response = self.client.post(
            reverse("account_update"),
            {"email": "[email protected]"},
        )

        self.assertEqual(response.status_code, 403)

    def test_get_does_not_change_email(self):
        original_email = self.user.email

        response = self.client.get(
            reverse("account_update"),
            {"email": "[email protected]"},
        )

        self.user.refresh_from_db()

        self.assertEqual(response.status_code, 200)
        self.assertEqual(self.user.email, original_email)