from grantflow.tests.security_reads_helpers import (
    assert_auth_pair,
    enable_read_auth,
    install_queue_admin_stub,
)


def test_ingest_read_endpoints_require_api_key_when_configured(monkeypatch):
    enable_read_auth(monkeypatch)

    for path in [
        "/ingest/recent",
        "/ingest/inventory",
        "/ingest/inventory/export",
    ]:
        assert_auth_pair("get", path)

    assert_auth_pair("post", "/ingest/readiness", json={"donor_id": "usaid"})


def test_queue_admin_endpoints_require_api_key_when_configured(monkeypatch):
    enable_read_auth(monkeypatch)
    install_queue_admin_stub(monkeypatch)

    for path in [
        "/queue/worker-heartbeat",
        "/queue/dead-letter",
        "/queue/dead-letter/export",
    ]:
        assert_auth_pair("get", path)

    assert_auth_pair("post", "/queue/dead-letter/requeue")
    assert_auth_pair("delete", "/queue/dead-letter")


def test_hitl_pending_requires_api_key_when_configured(monkeypatch):
    enable_read_auth(monkeypatch)

    assert_auth_pair("get", "/hitl/pending")
