"""Integration: betoniarka enforces the shared key on /clear_pr_pls (which
moved here from the musician during the radio split) while /ping stays open.

This is the same auth contract the musician test used to cover for
/clear_pr_pls, now exercised against the service that actually owns it.
"""
import betoniarka as b


def _client(tmp_path, key="test-secret"):
    b.API_KEY = key
    # /clear_pr_pls truncates this file; point it at a writable temp path so the
    # authorised case reaches 200 instead of failing on the default
    # /srv/betoniarka/data path that does not exist in CI.
    b.PRIORITY_PLAYLIST_PATH = tmp_path / "priority_queue.playlist"
    return b.app.test_client()


def test_clear_pr_pls_rejected_without_key(tmp_path):
    client = _client(tmp_path)
    assert client.get("/clear_pr_pls").status_code == 401


def test_clear_pr_pls_accepted_with_key(tmp_path):
    client = _client(tmp_path)
    resp = client.get(
        "/clear_pr_pls", headers={"X-Conjurer-Api-Key": "test-secret"}
    )
    assert resp.status_code == 200
    # The endpoint's job is to empty the priority playlist.
    assert b.PRIORITY_PLAYLIST_PATH.read_text() == ""


def test_ping_is_open(tmp_path):
    client = _client(tmp_path)
    assert client.get("/ping").status_code == 200


def test_open_when_key_unset(tmp_path):
    client = _client(tmp_path, key=None)
    assert client.get("/clear_pr_pls").status_code == 200