from fastapi import HTTPException
import pytest

from flashops_control.api.agents import _check_enrollment_token
from flashops_control.config import reset_settings


def test_production_agent_enrollment_is_fail_closed(monkeypatch):
    monkeypatch.setenv("FLASHOPS_ENV", "production")
    monkeypatch.delenv("FLASHOPS_AGENT_ENROLLMENT_TOKEN", raising=False)
    reset_settings()
    with pytest.raises(HTTPException) as missing:
        _check_enrollment_token(None)
    assert missing.value.status_code == 503

    monkeypatch.setenv("FLASHOPS_AGENT_ENROLLMENT_TOKEN", "enroll-secret")
    reset_settings()
    with pytest.raises(HTTPException) as invalid:
        _check_enrollment_token("wrong")
    assert invalid.value.status_code == 401
    _check_enrollment_token("enroll-secret")

    # Leave the global cache empty so later tests read the restored environment.
    reset_settings()
