"""API guard 테스트 — [WebServerConfig].api_keys 설정 시에만 /v1 에 X-API-Key 검증(개발=빈값=개방 모드).

auth.configured_keys 가 매 요청 config 를 읽으므로 monkeypatch.setattr 만으로 on/off 를 전환한다
(앱 재기동 불필요).
"""

import pytest

from config.server_configs import web_server_config


@pytest.fixture
def guarded(monkeypatch):
    monkeypatch.setattr(web_server_config, "api_keys", ["k1", "k2"])


async def test_open_mode_without_keys(client, monkeypatch):
    monkeypatch.setattr(web_server_config, "api_keys", [])
    r = await client.get("/v1/lps/queue/stats")       # 개방 모드 — 헤더 없이 통과
    assert r.status_code == 200


async def test_guarded_rejects_missing_header(client, guarded):
    r = await client.get("/v1/lps/queue/stats")
    assert r.status_code == 401


async def test_guarded_rejects_wrong_key(client, guarded):
    r = await client.get("/v1/lps/queue/stats", headers={"X-API-Key": "nope"})
    assert r.status_code == 401


async def test_guarded_accepts_any_configured_key(client, guarded):
    for key in ("k1", "k2"):                          # 복수 키 — 무중단 키 교체용
        r = await client.get("/v1/lps/queue/stats", headers={"X-API-Key": key})
        assert r.status_code == 200


async def test_guard_covers_post_search(client, guarded):
    r = await client.post("/v1/lps/search", json={"data": []})
    assert r.status_code == 401                       # enqueue(비용 발생 경로)도 보호


async def test_healthz_stays_open(client, guarded):
    assert (await client.get("/healthz")).status_code == 200   # LB 프로브는 guard 밖