import unittest
from fastapi.testclient import TestClient

import main
from db import connect, create


class TestRouteSurfaceLockdown(unittest.IsolatedAsyncioTestCase):
    async def asyncSetUp(self):
        self.conn = await connect(":memory:")
        await create(self.conn)

        async def override_get_db():
            try:
                yield self.conn
            finally:
                pass

        main.app.dependency_overrides[main.get_db] = override_get_db
        self.client = TestClient(main.app)

        # Register a user to obtain auth header for positive checks
        r = self.client.post(
            "/api/v1/auth/register",
            json={"email": "lock@test.com", "password": "pw", "displayName": "Lock"},
        )
        assert r.status_code == 200, r.text
        self.auth_headers = {"Authorization": f"Bearer {r.json()['accessToken']}"}

    async def asyncTearDown(self):
        await self.conn.close()
        main.app.dependency_overrides.clear()

    def test_unscoped_endpoints_not_exposed(self):
        # These v1-style unscoped paths should not exist
        for path in [
            "/api/v1/meals",
            "/api/v1/meals/1",
            "/api/v1/shopping/current",
            "/api/v1/shopping/1",
        ]:
            r = self.client.get(path)
            assert r.status_code in (404, 405)

    def test_protected_routes_require_auth(self):
        # Household routes require Authorization (401 when missing)
        # Use a slug that won't exist; should return 401 before 404 membership/not found checks
        r = self.client.get("/api/v1/households/nope/whoami")
        assert r.status_code == 401

        # With auth, not found or forbidden are possible; whoami returns 404 for missing household
        r2 = self.client.get("/api/v1/households/nope/whoami", headers=self.auth_headers)
        assert r2.status_code == 404