from grantflow.tests.security_reads_helpers import (
    assert_auth_pair,
    create_generated_job,
    enable_read_auth,
)


def test_status_artifact_read_endpoints_require_api_key_when_configured(monkeypatch):
    enable_read_auth(monkeypatch)
    job_id = create_generated_job()

    for path in [
        f"/status/{job_id}",
        f"/status/{job_id}/citations",
        f"/status/{job_id}/export-payload",
        f"/status/{job_id}/versions",
        f"/status/{job_id}/diff",
        f"/status/{job_id}/events",
        f"/status/{job_id}/events/export",
        f"/status/{job_id}/hitl/history",
        f"/status/{job_id}/hitl/history/export",
        f"/status/{job_id}/metrics",
        f"/status/{job_id}/quality",
        f"/status/{job_id}/grounding-gate",
        f"/status/{job_id}/critic",
    ]:
        assert_auth_pair("get", path)
