"""Security validation — auth gate when AUTH_REQUIRED is true."""
from __future__ import annotations

import pytest
from httpx import ASGITransport, AsyncClient

from app.core.config import settings
from app.main import app
from app.tests.conftest import TENANT_A, tenant_headers


@pytest.mark.asyncio
async def test_auth_required_rejects_anonymous():
    original = settings.auth_required
    settings.auth_required = True
    try:
        transport = ASGITransport(app=app)
        async with AsyncClient(transport=transport, base_url="http://testserver") as client:
            resp = await client.get(
                "/api/v1/venues",
                headers=tenant_headers(TENANT_A),
            )
            assert resp.status_code == 401
    finally:
        settings.auth_required = original