"""One L0 access matrix for otherwise-identical route boundary checks."""

from __future__ import annotations

import pytest

_AUTHENTICATED_GET_ROUTES = (
    "/api/v1/approval/admin/all-requests",
    "/api/v1/approval/admin/overview",
    "/api/v1/cmdb/dns-records",
    "/api/v1/dashboard/cockpit",
    "/api/v1/m/aggregate/inbox",
    "/api/v1/m/apps/catalog",
    "/api/v1/me/cohort",
    "/api/v1/me/device-gallery",
    "/api/v1/me/footprint",
    "/api/v1/me/loadout",
    "/api/v1/me/requests",
    "/api/v1/me/requests/detail?id=vpn:abc",
    "/api/v1/me/requests/export.xlsx",
    "/api/v1/me/team/api-keys",
    "/api/v1/me/team/cloud",
    "/api/v1/me/team/footprint",
    "/api/v1/me/team/requests",
    "/api/v1/me/team/requests/export.xlsx",
    "/api/v1/me/todos/done",
    "/api/v1/me/todos/done/stats",
    "/api/v1/me/welcome",
)

_EMPLOYEE_FORBIDDEN_GET_ROUTES = (
    "/api/v1/admin/health/overview",
    "/api/v1/admin/reconciliation/overview",
    "/api/v1/approval/admin/all-requests",
    "/api/v1/approval/admin/overview",
    "/api/v1/approval/admin/overview/export.xlsx",
    "/api/v1/arcade/admin/economy",
    "/api/v1/assets/hardware-prep",
    "/api/v1/assets/software-catalog/export.xlsx",
    "/api/v1/assets/software-catalog/it-service-architecture",
    "/api/v1/auditor/findings/export.xlsx",
    "/api/v1/auth/departments/tree",
    "/api/v1/cmdb/overview/admin",
    "/api/v1/dashboard/cockpit",
    "/api/v1/google-workspace/orphans/export",
    "/api/v1/identity-sync/mapping-metadata",
    "/api/v1/identity-sync/overview",
    "/api/v1/notifications/outbox/export.xlsx",
    "/api/v1/offboarding/processes/export.xlsx",
    "/api/v1/onboarding/processes/export.xlsx",
    "/api/v1/procurement/orders/export.xlsx",
    "/api/v1/provisioning/analytics",
    "/api/v1/provisioning/tasks/export.xlsx",
    "/api/v1/role-changes",
)


@pytest.mark.asyncio
@pytest.mark.parametrize("path", _AUTHENTICATED_GET_ROUTES)
async def test_get_route_requires_authentication(client, path: str) -> None:
    response = await client.get(path)

    assert response.status_code == 401, path


@pytest.mark.asyncio
@pytest.mark.parametrize("path", _EMPLOYEE_FORBIDDEN_GET_ROUTES)
async def test_get_route_rejects_plain_employee(
    client,
    employee_headers,
    path: str,
) -> None:
    response = await client.get(path, headers=employee_headers)

    assert response.status_code == 403, path