"""Health-check, CORS, and cross-cutting negative-path integration tests.

These exercise behaviour wired up in app.php (health check route, CORS
``after`` hook, Correlation-Id echo) and the ``\\d+`` route asserts shared by
the carveout GET endpoints. None of them mutate data.
"""
import pytest

from Integration.consts import api
from Integration.utils import assert_ok


@pytest.mark.smoke
def test_health_check(http):
    """The /hello/ health endpoint returns {'status': 'ok'}."""
    response = assert_ok(http.get(api.HEALTH_CHECK))
    assert response.json() == {"status": "ok"}


@pytest.mark.read
def test_cors_header_present(http):
    """The after-hook sets a permissive CORS origin on responses."""
    response = http.get(api.STORE_LIST)
    assert response.headers.get("Access-Control-Allow-Origin") == "*"


@pytest.mark.read
def test_correlation_id_is_echoed(http):
    """A supplied Correlation-Id is echoed back in the response headers."""
    correlation_id = "integration-test-correlation-id"
    response = http.get(
        api.STORE_LIST, headers={"Correlation-Id": correlation_id})
    assert response.headers.get("Correlation-Id") == correlation_id


@pytest.mark.read
def test_cors_preflight_options(http):
    """An OPTIONS preflight is answered 200 with the CORS allow headers."""
    response = http.options(api.STORE_LIST)
    assert response.status_code == 200, response.url
    assert response.headers.get("Access-Control-Allow-Origin") == "*"
    assert "GET" in (response.headers.get("Access-Control-Allow-Methods") or "")


@pytest.mark.negative
def test_unknown_route_not_found(http):
    """An unmapped path returns the JSON 404 handler from app.php."""
    response = http.get(api.BASE_URL + "/this/route/does/not/exist")
    assert response.status_code == 404, response.url


# UPC-bearing GET endpoints that assert the upc segment as \d+. A non-numeric
# upc should not match the route and must therefore 404.
_NON_NUMERIC_UPC_ENDPOINTS = [
    api.RELEASE_ALL,
    api.RELEASE_STORE,
    api.RELEASE_TERRITORY,
    api.COMBINED_ALL,
    api.COMBINED_STORE,
    api.COMBINED_TERRITORY,
]


@pytest.mark.negative
@pytest.mark.parametrize("url_template", _NON_NUMERIC_UPC_ENDPOINTS)
def test_non_numeric_upc_returns_not_found(http, url_template):
    """Non-numeric upc fails the \\d+ route assert across read endpoints."""
    response = http.get(url_template.format(upc="not-a-upc"))
    assert response.status_code == 404, response.url


@pytest.mark.read
def test_numeric_unknown_upc_still_routes(http):
    """A numeric upc always matches the \\d+ route and returns 200, even when no
    release exists for it — existence is not a routing concern. This is the
    positive counterpart to the non-numeric 404 case above.
    """
    response = http.get(api.RELEASE_ALL.format(upc="000000000000"))
    assert response.status_code == 200, response.url