"""Security headers, selective gzip and the browser crash beacon."""
from fastapi.testclient import TestClient

import main

client = TestClient(main.app)


def test_security_headers_present():
    r = client.get("/api/health")
    assert r.headers["X-Frame-Options"] == "DENY"
    assert "camera=(self)" in r.headers["Permissions-Policy"]
    assert r.headers["X-Content-Type-Options"] == "nosniff"


def test_client_error_beacon_accepts_and_validates():
    ok = client.post("/api/client-error", json={"message": "boom", "stack": "at X", "url": "/"})
    assert ok.status_code == 204
    too_long = client.post("/api/client-error", json={"message": "x" * 600})
    assert too_long.status_code == 422


def test_json_is_gzipped_when_large():
    r = client.get("/api/health", headers={"Accept-Encoding": "gzip"})
    assert r.status_code == 200  # small body: not compressed, but the middleware must not break it