"""
CORS must never end up as "any origin, WITH credentials".

Starlette does not reject `allow_origins=["*"]` combined with
`allow_credentials=True`. It reflects the caller's Origin back in
Access-Control-Allow-Origin and still sends
Access-Control-Allow-Credentials: true, so the effective policy is the
opposite of what a wildcard usually means. main.py defuses that by turning
credentials off whenever it sees a wildcard; these tests hold it to that.

The policy lives in a pure function so it can be exercised directly --
reloading app.main to vary settings drags every router back through import
and is not worth the fragility.
"""
from starlette.middleware.cors import CORSMiddleware

from app.config import settings
from app.main import app, cors_allows_credentials


def test_wildcard_alone_disables_credentials():
    assert cors_allows_credentials(["*"]) is False


def test_wildcard_among_real_origins_still_disables_credentials():
    # A list that merely CONTAINS "*" is as permissive as ["*"] alone --
    # Starlette treats any wildcard entry as allow-all.
    assert cors_allows_credentials(["https://app.example.com", "*"]) is False


def test_named_origins_keep_credentials():
    # Naming your origins is how you ask for credentialed requests, so a
    # correctly configured deployment must not be penalised.
    assert cors_allows_credentials(["https://app.example.com"]) is True
    assert cors_allows_credentials([]) is True


def test_the_app_actually_mounted_that_policy():
    """Guards the wiring, not just the helper: a future edit to main.py that
    hardcodes allow_credentials=True again fails here."""
    opts = next(
        (mw.kwargs for mw in app.user_middleware if mw.cls is CORSMiddleware), None
    )
    assert opts is not None, "CORSMiddleware is not mounted at all"
    assert opts["allow_credentials"] is cors_allows_credentials(settings.cors_origins)


def test_health_exposes_a_build_stamp():
    """CI compares this against the commit it just deployed; a deploy that
    leaves the previous container running is otherwise invisible."""
    from app.main import _GIT_SHA

    assert isinstance(_GIT_SHA, str) and _GIT_SHA