tests/test_routes_pricing.py

from fastapi.testclient import TestClient
from app.main import app

client = TestClient(app)


def test_run_pricing_is_temporarily_disabled():
    """/pricing/run was disabled after AUDIT_arf-bayesian-pricing-calculator.md's
    Critical finding: it persisted a fabricated random.random() outcome into a
    calibration buffer with no customer_id scoping, so every customer's price
    was shaped by every other customer's fabricated outcomes. This asserts the
    disabled state itself, not the old (buggy) behavior -- update this test
    when the endpoint is actually fixed and re-enabled, not before."""
    response = client.post(
        "/api/v1/pricing/run",
        json={"input": {}, "customer_id": "test-customer", "runs": 1},
    )
    assert response.status_code == 503
    assert "temporarily disabled" in response.json()["detail"].lower()


def test_run_pricing_still_requires_auth():
    """Disabling the endpoint must not also disable its auth -- conftest.py's
    mock_enforce_quota makes every request "authenticated" for this test
    client, so this only confirms the Depends(enforce_quota) dependency is
    still declared and still runs before the handler body (i.e. it wasn't
    accidentally dropped along with the rest of the function body); it does
    not exercise the real 401/403 paths, which are covered by test_deps.py
    and usage_tracker's own tests."""
    response = client.post(
        "/api/v1/pricing/run",
        json={"input": {}, "customer_id": "test-customer", "runs": 1},
    )
    # Reaching the 503 (not erroring before it) proves enforce_quota resolved
    # successfully -- if the dependency were missing or broken, this would be
    # a 401/422/500 instead.
    assert response.status_code == 503


def test_estimate_pricing_route_still_registered():
    """/pricing/estimate was not touched by the disable -- confirm it's still
    a distinct, reachable route (a malformed request should 400, not 503/404),
    so a caller following the "use /pricing/estimate instead" guidance in the
    503 detail message actually has somewhere to go."""
    response = client.post("/api/v1/pricing/estimate", json={"input": {}})
    assert response.status_code != 503
    assert response.status_code != 404