"""`require_valid_secret` — miroir inversé de
`require-internal-worker.test.ts` côté `apps/api`. Utilise la fixture
`client` partagée (`conftest.py`) — pas besoin d'une app entraînée
séparément juste pour tester l'authentification.
"""

from fastapi.testclient import TestClient

from intent_service.config import settings


def test_rejects_a_missing_secret(client: TestClient):
    response = client.post("/v1/process", json={"locale": "fr", "text": "faire fondre"})
    assert response.status_code == 401


def test_rejects_a_wrong_secret(client: TestClient):
    response = client.post(
        "/v1/process",
        json={"locale": "fr", "text": "faire fondre"},
        headers={"X-Intent-Service-Secret": "not-the-right-secret"},
    )
    assert response.status_code == 401


def test_accepts_the_configured_secret(client: TestClient):
    response = client.post(
        "/v1/process",
        json={"locale": "fr", "text": "faire fondre"},
        headers={"X-Intent-Service-Secret": settings.intent_service_secret},
    )
    assert response.status_code == 200


def test_health_requires_no_secret(client: TestClient):
    response = client.get("/health")
    assert response.status_code == 200