"""Regression tests for external attack-surface hardening (BL-01–BL-04)."""

import pytest


class TestPublicPathMatching:
    def test_health_detail_not_public(self):
        from server.api.auth_jwt import _is_public_path

        assert _is_public_path("/health") is True
        assert _is_public_path("/health/detail") is False

    def test_bing_wallpapers_get_public_post_sync_protected(self):
        from server.api.auth_jwt import _is_public_path

        assert _is_public_path("/api/settings/bing-wallpapers", "GET") is True
        assert _is_public_path("/api/settings/bing-wallpaper", "GET") is True
        assert _is_public_path("/api/settings/bing-wallpapers/sync", "POST") is False

    def test_openapi_docs_off_by_default(self):
        from server.api.auth_jwt import _is_public_path

        assert _is_public_path("/openapi.json") is False
        assert _is_public_path("/docs") is False
        assert _is_public_path("/redoc") is False

    def test_agent_install_ws_prefixes_still_public(self):
        from server.api.auth_jwt import _is_public_path

        assert _is_public_path("/api/agent/heartbeat") is True
        assert _is_public_path("/api/install/status") is True
        assert _is_public_path("/ws/alerts") is True