from grantflow.tests.security_openapi_helpers import AGENT_CREDENTIAL_SECURITY, openapi_spec, security_for


def test_openapi_declares_api_key_security_scheme():
    spec = openapi_spec()

    schemes = (spec.get("components") or {}).get("securitySchemes") or {}
    assert "ApiKeyAuth" in schemes
    assert schemes["ApiKeyAuth"]["type"] == "apiKey"
    assert schemes["ApiKeyAuth"]["in"] == "header"
    assert schemes["ApiKeyAuth"]["name"] == "X-API-Key"
    assert schemes["BearerAuth"]["type"] == "http"
    assert schemes["BearerAuth"]["scheme"] == "bearer"


def test_openapi_declares_api_key_security_on_protected_routes():
    spec = openapi_spec()

    protected_routes = [
        ("/generate", "post"),
        ("/generate/from-preset", "post"),
        ("/generate/from-preset/batch", "post"),
        ("/generate/preflight", "post"),
        ("/ingest", "post"),
        ("/ingest/readiness", "post"),
        ("/ingest/recent", "get"),
        ("/ingest/inventory", "get"),
        ("/ingest/inventory/export", "get"),
        ("/queue/worker-heartbeat", "get"),
        ("/queue/dead-letter", "get"),
        ("/queue/dead-letter/export", "get"),
        ("/queue/dead-letter/requeue", "post"),
        ("/queue/dead-letter", "delete"),
        ("/cancel/{job_id}", "post"),
        ("/status/{job_id}", "get"),
        ("/status/{job_id}/citations", "get"),
        ("/status/{job_id}/export-payload", "get"),
        ("/status/{job_id}/versions", "get"),
        ("/status/{job_id}/diff", "get"),
        ("/status/{job_id}/events", "get"),
        ("/status/{job_id}/events/export", "get"),
        ("/status/{job_id}/hitl/history", "get"),
        ("/status/{job_id}/hitl/history/export", "get"),
        ("/status/{job_id}/metrics", "get"),
        ("/status/{job_id}/quality", "get"),
        ("/status/{job_id}/grounding-gate", "get"),
        ("/status/{job_id}/critic", "get"),
        ("/status/{job_id}/critic/findings", "get"),
        ("/status/{job_id}/critic/findings/{finding_id}", "get"),
        ("/status/{job_id}/critic/findings/{finding_id}/ack", "post"),
        ("/status/{job_id}/critic/findings/{finding_id}/open", "post"),
        ("/status/{job_id}/critic/findings/{finding_id}/resolve", "post"),
        ("/status/{job_id}/critic/findings/bulk-status", "post"),
        ("/status/{job_id}/comments", "get"),
        ("/status/{job_id}/comments/export", "get"),
        ("/status/{job_id}/comments", "post"),
        ("/status/{job_id}/comments/bulk-status", "post"),
        ("/status/{job_id}/comments/{comment_id}/ack", "post"),
        ("/status/{job_id}/comments/{comment_id}/resolve", "post"),
        ("/status/{job_id}/comments/{comment_id}/reopen", "post"),
        ("/status/{job_id}/review/workflow", "get"),
        ("/status/{job_id}/review/workflow/trends", "get"),
        ("/status/{job_id}/review/workflow/trends/export", "get"),
        ("/status/{job_id}/review/workflow/sla", "get"),
        ("/status/{job_id}/review/workflow/sla/export", "get"),
        ("/status/{job_id}/review/workflow/sla/hotspots", "get"),
        ("/status/{job_id}/review/workflow/sla/hotspots/export", "get"),
        ("/status/{job_id}/review/workflow/sla/hotspots/trends", "get"),
        ("/status/{job_id}/review/workflow/sla/hotspots/trends/export", "get"),
        ("/status/{job_id}/review/workflow/sla/trends", "get"),
        ("/status/{job_id}/review/workflow/sla/trends/export", "get"),
        ("/status/{job_id}/review/workflow/sla/profile", "get"),
        ("/status/{job_id}/review/workflow/sla/recompute", "post"),
        ("/status/{job_id}/review/workflow/export", "get"),
        ("/portfolio/metrics", "get"),
        ("/portfolio/metrics/export", "get"),
        ("/portfolio/quality", "get"),
        ("/portfolio/quality/export", "get"),
        ("/portfolio/review-workflow", "get"),
        ("/portfolio/review-workflow/export", "get"),
        ("/portfolio/review-workflow/sla", "get"),
        ("/portfolio/review-workflow/sla/export", "get"),
        ("/portfolio/review-workflow/sla/hotspots", "get"),
        ("/portfolio/review-workflow/sla/hotspots/export", "get"),
        ("/portfolio/review-workflow/sla/hotspots/trends", "get"),
        ("/portfolio/review-workflow/sla/hotspots/trends/export", "get"),
        ("/portfolio/review-workflow/trends", "get"),
        ("/portfolio/review-workflow/trends/export", "get"),
        ("/portfolio/review-workflow/sla/trends", "get"),
        ("/portfolio/review-workflow/sla/trends/export", "get"),
    ]

    for path, method in protected_routes:
        assert security_for(spec, path, method) == AGENT_CREDENTIAL_SECURITY
