"""CORS is configured so the dashboard (a different origin) can call the API."""

from __future__ import annotations


def test_cors_allows_the_dashboard_origin(client):
    resp = client.get("/health", headers={"Origin": "http://localhost:3000"})
    assert resp.status_code == 200
    assert resp.headers.get("access-control-allow-origin") == "http://localhost:3000"


def test_cors_omits_unknown_origins(client):
    resp = client.get("/health", headers={"Origin": "http://evil.example.com"})
    # Starlette only echoes the header for allowed origins.
    assert resp.headers.get("access-control-allow-origin") != "http://evil.example.com"
