"""RBAC wiring invariants (Val 2).

Asserts that human-facing read routers carry the auth dependency, while the
service-to-service routers (config polling, ingest) stay open — breaking the
latter would cut config propagation / event ingestion to the AI services.
"""

from __future__ import annotations

from dashboard.api.routes import (
    audit,
    catalog,
    config,
    history,
    ingest,
    monitoring,
    proxy,
    stats,
)


def test_human_read_routers_are_protected():
    for r in (
        monitoring.router,
        stats.router,
        history.router,
        audit.router,
        proxy.router,
        catalog.router,
    ):
        assert len(r.dependencies) >= 1, "expected router-level auth dependency"


def test_service_routers_stay_open():
    # config (polled by AI services) and ingest (service-to-service) must NOT
    # gain router-level auth — that would break the platform.
    assert len(config.router.dependencies) == 0
    assert len(ingest.router.dependencies) == 0