"""V8.28: secured user journey remains mapped to existing FastAPI controls."""
from pathlib import Path
from test_factory import client

ROOT=Path(__file__).resolve().parents[1]

def test_launch_center_is_reachable_from_workspace(client):
    response=client.get('/')
    assert response.status_code==200
    assert 'data-view="launch"' in response.text
    assert '检查并上线' in response.text
    assert '/ui/workspace-launch.js' in response.text
    assert client.get('/ui/workspace-launch.js').status_code==200

def test_steps_use_existing_production_api_and_preserve_csrf(client):
    script=client.get('/ui/workspace.js').text
    for name in ('function launch()', 'function launchRequestApproval()', 'function launchPreflight()', 'function launchDeploy()', 'function resetLaunch()'):
        assert name in script
    for route in ('/release-requests', '/preflight/', '/deploy'):
        assert route in script
    assert "headers['X-SiteForge-CSRF']=state.csrf" in script
    assert 'Idempotency-Key' in script
    assert '已经检查此版本' in script
    assert '提交部署只是创建任务' in script

def test_preflight_for_nonexistent_build_is_not_marked_ready(client):
    # The administrative fixture is a superadmin. Missing builds must still fail closed.
    result=client.get('/api/production/sites/not-your-website/preflight/something')
    assert result.status_code in (403,404) or (result.status_code==200 and result.json().get('ready') is False)

def test_new_client_side_gates_do_not_change_server_approval_requirement(client):
    site=client.post('/api/sites',json={'name':'V828 审批保护','theme':'corporate','mode':'new'})
    assert site.status_code==201
    sid=site.json()['id']
    # Unauthorized to deploy a nonexistent or unapproved version, even if client is bypassed.
    response=client.post(f'/api/production/sites/{sid}/deploy',json={'build_id':'fake-build','target':'production'})
    assert response.status_code in (400,403,404,409,503)