from fastapi.testclient import TestClient
from scopewrit.inspect_api import app
from test_inspect import manifest

def test_public_preflight_is_stateless_and_cannot_authorize():
    with TestClient(app) as client:
        response=client.post('/api/inspect',content=manifest().model_dump_json())
        assert response.status_code==200
        assert response.json()['authority_granted'] is False
        assert client.post('/api/authorize',json={}).status_code==404

def test_preflight_bounds_and_rejects_invalid_input():
    with TestClient(app) as client:
        assert client.post('/api/inspect',content='x'*262145).status_code==413
        assert client.post('/api/inspect',content='rules: []\nrules: []').status_code==400
        assert client.post('/api/inspect',content='loop: &loop {x: *loop}').status_code==400
        assert client.post('/api/inspect',content='? [a,b]\n: value').status_code==400
