"""`require_valid_secret` — miroir inversé de
`require-internal-worker.test.ts` côté `apps/api`."""

import pytest
from fastapi.testclient import TestClient

from intent_service.config import settings
from intent_service.main import app


@pytest.fixture
def client():
    with TestClient(app) as test_client:
        yield test_client


def test_rejects_a_missing_secret(client: TestClient):
    response = client.post("/v1/process", json={"locale": "fr", "text": "faire fondre"})
    assert response.status_code == 401


def test_rejects_a_wrong_secret(client: TestClient):
    response = client.post(
        "/v1/process",
        json={"locale": "fr", "text": "faire fondre"},
        headers={"X-Intent-Service-Secret": "not-the-right-secret"},
    )
    assert response.status_code == 401


def test_accepts_the_configured_secret(client: TestClient):
    response = client.post(
        "/v1/process",
        json={"locale": "fr", "text": "faire fondre"},
        headers={"X-Intent-Service-Secret": settings.intent_service_secret},
    )
    assert response.status_code == 200


def test_health_requires_no_secret(client: TestClient):
    response = client.get("/health")
    assert response.status_code == 200