from starlette.applications import Starlette
from starlette.responses import PlainTextResponse
from starlette.routing import Route
from starlette.testclient import TestClient

from qonto_assistant.mcp_auth import BearerTokenAuthMiddleware


def _protected_app() -> Starlette:
    async def ok(request):
        return PlainTextResponse("ok")

    app = Starlette(routes=[Route("/", ok)])
    app.add_middleware(BearerTokenAuthMiddleware, token="secret-token")
    return app


def test_bearer_auth_rejects_missing_header() -> None:
    client = TestClient(_protected_app())
    response = client.get("/")
    assert response.status_code == 401
    assert response.json()["error_code"] == "unauthorized"


def test_bearer_auth_rejects_wrong_token() -> None:
    client = TestClient(_protected_app())
    response = client.get("/", headers={"Authorization": "Bearer wrong-token"})
    assert response.status_code == 401


def test_bearer_auth_accepts_matching_token() -> None:
    client = TestClient(_protected_app())
    response = client.get("/", headers={"Authorization": "Bearer secret-token"})
    assert response.status_code == 200
    assert response.text == "ok"