"""tests/test_security_headers.py — Verify security headers on both portals."""


def test_admin_security_headers(admin_client):
    resp = admin_client.get("/admin/login")
    assert resp.headers.get("X-Content-Type-Options") == "nosniff"
    assert "X-Frame-Options" in resp.headers
    assert "Referrer-Policy" in resp.headers


def test_tenant_security_headers(tenant_client):
    resp = tenant_client.get("/login")
    assert resp.headers.get("X-Content-Type-Options") == "nosniff"
    assert "X-Frame-Options" in resp.headers
    assert "Content-Security-Policy" in resp.headers


def test_checkin_kiosk_404_bad_slug(tenant_client):
    resp = tenant_client.get("/checkin/INVALID_SLUG!!!")
    assert resp.status_code == 404


def test_checkin_kiosk_404_unknown_tenant(tenant_client):
    resp = tenant_client.get("/checkin/valid-but-unknown-slug")
    assert resp.status_code == 404