from grantflow.tests.security_reads_helpers import (
    assert_auth_pair,
    create_generated_job,
    enable_read_auth,
)


def test_review_workflow_read_endpoints_require_api_key_when_configured(monkeypatch):
    enable_read_auth(monkeypatch)
    job_id = create_generated_job()

    for path in [
        f"/status/{job_id}/review/workflow",
        f"/status/{job_id}/review/workflow/trends",
        f"/status/{job_id}/review/workflow/sla",
        f"/status/{job_id}/review/workflow/sla/hotspots",
        f"/status/{job_id}/review/workflow/sla/hotspots/export",
        f"/status/{job_id}/review/workflow/sla/hotspots/trends",
        f"/status/{job_id}/review/workflow/sla/hotspots/trends/export",
        f"/status/{job_id}/review/workflow/sla/trends",
        f"/status/{job_id}/review/workflow/sla/trends/export",
        f"/status/{job_id}/review/workflow/sla/export",
        f"/status/{job_id}/review/workflow/sla/profile",
        f"/status/{job_id}/review/workflow/export",
        f"/status/{job_id}/review/workflow/trends/export",
    ]:
        assert_auth_pair("get", path)


def test_review_workflow_sla_recompute_requires_api_key_when_configured(monkeypatch):
    enable_read_auth(monkeypatch)
    job_id = create_generated_job()

    assert_auth_pair("post", f"/status/{job_id}/review/workflow/sla/recompute")
