"""E2E tests for triples whose success requires live external backends (Flava
Object Storage write/read, Athenz ZTS, egress proxy, the explorer subprocess,
self-reachable HTTP).

Skipped unless E2E_WITH_BACKENDS=1 (supply credentials via env where needed).
When skipped, these (method, path, status) triples appear as *missing* in the
API coverage report — an honest reflection that reaching them needs real
infrastructure. See docs/openapi.yaml entries marked x-requires-external: true.
"""

import os

import pytest

pytestmark = pytest.mark.e2e

if os.environ.get("E2E_WITH_BACKENDS") != "1":
    pytest.skip(
        "external backends not available — set E2E_WITH_BACKENDS=1 (and required "
        "credentials) to exercise these endpoints",
        allow_module_level=True,
    )

BUCKET = os.environ.get("E2E_FOS_BUCKET", "cqa-test-bucket")
OBJECT = os.environ.get("E2E_FOS_OBJECT", "fos_test.txt")


# ── Object storage success / not-found ───────────────────────────────────────
def test_create_fos_object_ok(api):
    api.check(
        "PUT",
        "/create_fos_object/{bucket_name}/{object_name}",
        f"/create_fos_object/{BUCKET}/{OBJECT}",
        200,
        json={"env": "prod", "data": "payload"},
    )


def test_download_objects_ok(api):
    api.check(
        "GET",
        "/download_objects/{bucket_name}/{object_name}",
        f"/download_objects/{BUCKET}/{OBJECT}",
        200,
    )


def test_delete_fos_object_ok(api):
    api.check(
        "DELETE",
        "/delete_fos_object/{bucket_name}/{object_name}",
        f"/delete_fos_object/{BUCKET}/{OBJECT}",
        200,
    )


def test_delete_fos_object_not_found(api):
    api.check(
        "DELETE",
        "/delete_fos_object/{bucket_name}/{object_name}",
        f"/delete_fos_object/{BUCKET}/missing-object",
        404,
    )


# ── Athenz (real cert material + reachable ZTS required) ─────────────────────
def test_app_runner_access_token_ok(api):
    api.check(
        "GET",
        "/api/app_runner/get_access_token",
        "/api/app_runner/get_access_token?product_domain=dom",
        200,
    )