Upload tests/test_health.py

tests/test_health.py

@@ -0,0 +1,47 @@
+"""Health endpoint tests."""
+
+from __future__ import annotations
+
+from httpx import AsyncClient
+
+
+async def test_health_ok(client: AsyncClient) -> None:
+    """GET /health returns 200 with status, db, version fields."""
+    resp = await client.get("/health")
+    assert resp.status_code == 200, resp.text
+    data = resp.json()
+    assert data["status"] == "ok"
+    assert data["db"] == "ok"
+    assert "version" in data
+    assert isinstance(data["version"], str)
+
+
+async def test_health_no_auth_required(client: AsyncClient) -> None:
+    """GET /health works without an Authorization header (for Coolify healthcheck)."""
+    # No Authorization header at all
+    resp = await client.get("/health")
+    assert resp.status_code == 200, resp.text
+    # Even with a bogus header, it should still be 200 (public endpoint)
+    resp = await client.get(
+        "/health", headers={"Authorization": "Bearer not-a-real-token"}
+    )
+    assert resp.status_code == 200, resp.text
+
+
+async def test_api_v1_health_ok(client: AsyncClient) -> None:
+    """GET /api/v1/health returns 200 (versioned healthcheck)."""
+    resp = await client.get("/api/v1/health")
+    assert resp.status_code == 200, resp.text
+    data = resp.json()
+    assert data["status"] == "ok"
+    assert data["db"] == "ok"
+    assert "version" in data
+
+
+async def test_security_headers_on_health(client: AsyncClient) -> None:
+    """Security headers (CSP, X-Frame-Options, X-Content-Type-Options) are set on responses."""
+    resp = await client.get("/health")
+    assert resp.status_code == 200
+    assert "Content-Security-Policy" in resp.headers
+    assert resp.headers["X-Frame-Options"] == "DENY"
+    assert resp.headers["X-Content-Type-Options"] == "nosniff"