crm-system/tests/test_health.py

"""Health endpoint tests."""

from __future__ import annotations

from httpx import AsyncClient


async def test_health_ok(client: AsyncClient) -> None:
    """GET /health returns 200 with status, db, version fields."""
    resp = await client.get("/health")
    assert resp.status_code == 200, resp.text
    data = resp.json()
    assert data["status"] == "ok"
    assert data["db"] == "ok"
    assert "version" in data
    assert isinstance(data["version"], str)


async def test_health_no_auth_required(client: AsyncClient) -> None:
    """GET /health works without an Authorization header (for Coolify healthcheck)."""
    # No Authorization header at all
    resp = await client.get("/health")
    assert resp.status_code == 200, resp.text
    # Even with a bogus header, it should still be 200 (public endpoint)
    resp = await client.get("/health", headers={"Authorization": "Bearer not-a-real-token"})
    assert resp.status_code == 200, resp.text


async def test_api_v1_health_ok(client: AsyncClient) -> None:
    """GET /api/v1/health returns 200 (versioned healthcheck)."""
    resp = await client.get("/api/v1/health")
    assert resp.status_code == 200, resp.text
    data = resp.json()
    assert data["status"] == "ok"
    assert data["db"] == "ok"
    assert "version" in data


async def test_security_headers_on_health(client: AsyncClient) -> None:
    """Security headers (CSP, X-Frame-Options, X-Content-Type-Options) are set on responses."""
    resp = await client.get("/health")
    assert resp.status_code == 200
    assert "Content-Security-Policy" in resp.headers
    assert resp.headers["X-Frame-Options"] == "DENY"
    assert resp.headers["X-Content-Type-Options"] == "nosniff"