"""Integration: the musician Flask service enforces the shared key on its
authenticated endpoints while leaving the open ones reachable.

/clear_pr_pls used to live here but moved to betoniarka during the
musician/radio split - its auth contract is now covered in
test_betoniarka_auth.py. These tests exercise the same contract against an
endpoint the musician still serves.
"""
import conjurer_musician as m

# An authenticated endpoint the musician still owns. The body passes the
# endpoint's own validation, so a permitted request reaches 200 rather than a
# 400 that would not distinguish auth from a bad payload.
AUTHED_ENDPOINT = "/get_share_list"
VALID_BODY = {"entries": 1, "keywords": ["conjurer"]}


def _client(key="test-secret"):
    m.API_KEY = key
    return m.app.test_client()


def test_authed_endpoint_rejected_without_key():
    client = _client()
    assert client.post(AUTHED_ENDPOINT, json=VALID_BODY).status_code == 401


def test_authed_endpoint_accepted_with_key():
    client = _client()
    resp = client.post(
        AUTHED_ENDPOINT,
        json=VALID_BODY,
        headers={"X-Conjurer-Api-Key": "test-secret"},
    )
    assert resp.status_code == 200


def test_mp3_list_is_open():
    client = _client()
    resp = client.get("/mp3")
    assert resp.status_code == 200
    assert "music_file_list" in resp.get_json()


def test_open_when_key_unset():
    client = _client(key=None)
    assert client.post(AUTHED_ENDPOINT, json=VALID_BODY).status_code == 200