"""Tests for token-based auth (Bearer header validation)."""
import pytest


pytestmark = pytest.mark.asyncio


async def test_no_auth_header_returns_401(app_client):
    """GET /api/agents without Authorization header -> 401."""
    resp = await app_client.get("/api/agents")
    assert resp.status_code == 401


async def test_invalid_bearer_returns_401(app_client):
    """GET /api/agents with wrong Bearer token -> 401."""
    resp = await app_client.get("/api/agents", headers={"Authorization": "Bearer wrongtoken"})
    assert resp.status_code == 401


async def test_valid_bearer_returns_200(app_client, auth_headers, seed_agent):
    """GET /api/agents with correct Bearer -> 200 and list payload."""
    resp = await app_client.get("/api/agents", headers=auth_headers)
    assert resp.status_code == 200, resp.text
    body = resp.json()
    assert isinstance(body, list)
    assert any(a["id"] == "test_agent" for a in body)


async def test_health_endpoint_no_auth(app_client):
    """The /health endpoint is open: no auth header needed, returns 200."""
    resp = await app_client.get("/health")
    assert resp.status_code == 200


@pytest.mark.xfail(
    reason="C3 regression: auth.py uses .replace('Bearer ', '') which is case-sensitive. "
           "Lowercase 'bearer <token>' currently fails. Fix: use a case-insensitive prefix match.",
    strict=False,
)
async def test_case_insensitive_bearer(app_client, auth_headers, seed_agent):
    """C3 regression: lowercase 'bearer change-me-in-production' must work."""
    lower = {"Authorization": auth_headers["Authorization"].replace("Bearer ", "bearer ")}
    resp = await app_client.get("/api/agents", headers=lower)
    assert resp.status_code == 200, (
        f"expected 200 with lowercase 'bearer' prefix, got {resp.status_code}: {resp.text}"
    )