"""Test-only username/password login.

Lets load-testing tools (see loadtest/locustfile.py) authenticate local
Django accounts through AUTHENTICATION_BACKENDS' ModelBackend, entirely
bypassing SimpleCASBackend - so hammering this app under load never sends a
single request to the real CAS server at polylan.ch.

Only wired up in urls.py when settings.LOAD_TEST_LOGIN_ENABLED is true, and
that must stay off in production: it lets anyone who knows a local test
account's password log in without going through CAS at all. The "Create
load test users" admin action on CustomUser (see accounts/admin.py) is
hidden unless that same flag is set, as a second layer of the same guard
rail.
"""

from django.contrib.auth import authenticate, login
from django.http import HttpRequest, JsonResponse
from django.utils.decorators import method_decorator
from django.views import View
from django.views.decorators.csrf import csrf_exempt


@method_decorator(csrf_exempt, name="dispatch")
class TestLoginView(View):
    def post(self, request: HttpRequest):
        username = request.POST.get("username")
        password = request.POST.get("password")

        user = authenticate(request, username=username, password=password)
        if user is None:
            return JsonResponse({"detail": "invalid credentials"}, status=401)

        login(request, user)
        return JsonResponse({"detail": "ok"})