from __future__ import annotations

import pytest
from fastapi import HTTPException

from agent_platform.auth import decode_openwebui_identity, verify_service_bearer


def test_signed_identity_is_verified(identity_jwt: str, settings) -> None:
    identity = decode_openwebui_identity(identity_jwt, settings.openwebui_forward_jwt_secret)
    assert identity.user_id == "user-123"
    assert identity.email == "user@example.test"


def test_invalid_identity_is_rejected(settings) -> None:
    with pytest.raises(HTTPException) as error:
        decode_openwebui_identity("not-a-jwt", settings.openwebui_forward_jwt_secret)
    assert error.value.status_code == 401


def test_service_bearer_uses_exact_match() -> None:
    verify_service_bearer("Bearer expected", "expected")
    with pytest.raises(HTTPException) as error:
        verify_service_bearer("Bearer expect", "expected")
    assert error.value.status_code == 401