From e7ab652cba931fe294a6ab800b30d0958b82a3c2 Mon Sep 17 00:00:00 2001
From: Leopoldadmin <leopold.hammerschmidt@media-on.de>
Date: Wed, 3 Jun 2026 23:52:05 +0000
Subject: [PATCH] Upload tests/test_health.py

---
 tests/test_health.py | 47 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 tests/test_health.py

diff --git a/tests/test_health.py b/tests/test_health.py
new file mode 100644
index 0000000..404286d
--- /dev/null
+++ b/tests/test_health.py
@@ -0,0 +1,47 @@
+"""Health endpoint tests."""
+
+from __future__ import annotations
+
+from httpx import AsyncClient
+
+
+async def test_health_ok(client: AsyncClient) -> None:
+    """GET /health returns 200 with status, db, version fields."""
+    resp = await client.get("/health")
+    assert resp.status_code == 200, resp.text
+    data = resp.json()
+    assert data["status"] == "ok"
+    assert data["db"] == "ok"
+    assert "version" in data
+    assert isinstance(data["version"], str)
+
+
+async def test_health_no_auth_required(client: AsyncClient) -> None:
+    """GET /health works without an Authorization header (for Coolify healthcheck)."""
+    # No Authorization header at all
+    resp = await client.get("/health")
+    assert resp.status_code == 200, resp.text
+    # Even with a bogus header, it should still be 200 (public endpoint)
+    resp = await client.get(
+        "/health", headers={"Authorization": "Bearer not-a-real-token"}
+    )
+    assert resp.status_code == 200, resp.text
+
+
+async def test_api_v1_health_ok(client: AsyncClient) -> None:
+    """GET /api/v1/health returns 200 (versioned healthcheck)."""
+    resp = await client.get("/api/v1/health")
+    assert resp.status_code == 200, resp.text
+    data = resp.json()
+    assert data["status"] == "ok"
+    assert data["db"] == "ok"
+    assert "version" in data
+
+
+async def test_security_headers_on_health(client: AsyncClient) -> None:
+    """Security headers (CSP, X-Frame-Options, X-Content-Type-Options) are set on responses."""
+    resp = await client.get("/health")
+    assert resp.status_code == 200
+    assert "Content-Security-Policy" in resp.headers
+    assert resp.headers["X-Frame-Options"] == "DENY"
+    assert resp.headers["X-Content-Type-Options"] == "nosniff"