"""Every route answers 401 without a token, except a short, explicit list of public ones."""

from __future__ import annotations

import re

from fintracker.api.app import API_PREFIX

PUBLIC = {
    ("GET", f"{API_PREFIX}/health"),
    ("POST", f"{API_PREFIX}/auth/login"),
    ("POST", f"{API_PREFIX}/auth/refresh"),
    ("POST", f"{API_PREFIX}/auth/logout"),
}


def _routes(app) -> list[tuple[str, str]]:
    """(METHOD, path) for every documented operation. Walks the OpenAPI schema rather than
    `app.routes`: FastAPI nests included routers there in a private wrapper type."""
    return sorted(
        (method.upper(), path) for path, item in app.openapi()["paths"].items() for method in item
    )


async def test_every_route_but_the_public_ones_requires_a_token(app, client):
    routes = _routes(app)
    assert len(routes) > 50  # guards against the walk silently matching nothing
    assert set(routes) >= PUBLIC  # a renamed public route must update this list, not vanish

    open_routes = []
    for method, path in routes:
        if (method, path) in PUBLIC:
            continue
        url = re.sub(r"\{[^}]+\}", "1", path)
        r = await client.request(method, url)
        if r.status_code != 401:
            open_routes.append(f"{method} {path} -> {r.status_code}")
    assert not open_routes, "reachable without a token:\n" + "\n".join(open_routes)