# requires: fastapi, httpx, pytest
from fastapi.testclient import TestClient

from app import app

c = TestClient(app)
H = {"Authorization": "Bearer dev-only-key"}


def test_openapi_has_operation_and_server():
    spec = c.get("/openapi.json").json()
    op = spec["paths"]["/orders/{order_id}"]["get"]
    assert op["operationId"] == "getOrderStatus" and spec["servers"][0]["url"].startswith("http")
    assert "HTTPBearer" in spec["components"]["securitySchemes"]


def test_auth_and_isolation():
    assert c.get("/orders/A1001").status_code in (401, 403)
    assert c.get("/orders/A1001", headers={"Authorization": "Bearer wrong"}).status_code == 401
    assert c.get("/orders/A1001", headers=H).json()["status"] == "已发货"
    assert c.get("/orders/A1002", headers=H).status_code == 404      # 其他店铺的订单