"""Admin route registration — every endpoint must exist and require login.

ADMIN-003. The admin blueprint registers 10 routes. If one is accidentally
removed or renamed, the admin panel breaks silently. These tests walk the
URL map to catch that.
"""

import pytest


ADMIN_ROUTES = [
    '/admin',
    '/admin/backup/create',
    '/admin/toggle-tryouts',
    '/admin/season/start',
    '/admin/season/end',
    '/admin/teams/wipe',
]


def _redirected(response):
    return response.status_code in (301, 302)


class TestAdminRouteRegistration:
    @pytest.mark.parametrize('route', ADMIN_ROUTES)
    def test_route_is_registered(self, app, route):
        """Every admin endpoint must appear in the URL map."""
        adapter = app.url_map.bind('localhost')
        try:
            adapter.match(route, method='GET')
        except Exception:
            # Some routes are POST-only; try POST
            try:
                adapter.match(route, method='POST')
            except Exception as exc:
                pytest.fail(f'Route {route} is not registered: {exc}')

    @pytest.mark.parametrize('route', ADMIN_ROUTES)
    def test_route_requires_login(self, client, route):
        """Unauthenticated access must redirect to login."""
        response = client.get(route, follow_redirects=False)
        # POST-only routes return 405 on GET, which is fine — the point is
        # they don't return 200 to an anonymous caller.
        if response.status_code == 405:
            return
        assert _redirected(response), (
            f'{route} answered {response.status_code} to an anonymous caller'
        )