from grantflow.tests.security_reads_helpers import (
    assert_auth_pair,
    create_generated_job,
    enable_read_auth,
)


def test_critic_finding_status_mutations_require_api_key_when_configured(monkeypatch):
    enable_read_auth(monkeypatch)
    job_id = create_generated_job()
    critic = assert_auth_pair("get", f"/status/{job_id}/critic").json()

    if not critic.get("fatal_flaws"):
        return

    finding_id = critic["fatal_flaws"][0].get("finding_id")
    for path in [
        f"/status/{job_id}/critic/findings/{finding_id}/ack",
        f"/status/{job_id}/critic/findings/{finding_id}/resolve",
        f"/status/{job_id}/critic/findings/{finding_id}/open",
    ]:
        assert_auth_pair("post", path)

    assert_auth_pair(
        "post",
        f"/status/{job_id}/critic/findings/bulk-status",
        json={"next_status": "resolved", "finding_ids": [finding_id]},
    )


def test_comment_read_and_status_mutations_require_api_key_when_configured(monkeypatch):
    enable_read_auth(monkeypatch)
    job_id = create_generated_job()

    for path in [
        f"/status/{job_id}/comments",
        f"/status/{job_id}/comments/export",
    ]:
        assert_auth_pair("get", path)

    added_comment = assert_auth_pair(
        "post",
        f"/status/{job_id}/comments",
        json={"section": "general", "message": "Needs management review"},
    ).json()
    comment_id = added_comment["comment_id"]

    for path in [
        f"/status/{job_id}/comments/{comment_id}/resolve",
        f"/status/{job_id}/comments/{comment_id}/reopen",
    ]:
        assert_auth_pair("post", path)

    assert_auth_pair(
        "post",
        f"/status/{job_id}/comments/bulk-status",
        json={"next_status": "acknowledged", "apply_to_all": True},
    )
