"""Comments API tests reuse the routers harness (real FastAPI app wired
to the migrated `with_reporting_test` scratch DB, signed session cookies
per identity). The migrated fixture already carries the 2 real comments
(tests/migrate/fixtures/legacy_fixture.sql):

  11..01  author=rian  body 'remember to re-check May'  OPEN
  11..02  author=NULL (unmapped ghost)  body 'old note'  RESOLVED by adi

so the tenant baseline is 2 comments, 1 unresolved. Every test that
mutates state restores it (the scratch DB is shared, session-scoped).
"""

import pytest
from fastapi.testclient import TestClient

from app.main import create_app

# session-scoped migrated scratch DB + the per-identity client factory
from tests.reporting.conftest import (  # noqa: F401
    rpt_engine,
    rpt_session,
    rpt_url,
)
from tests.routers.conftest import (  # noqa: F401
    as_adi,
    as_rian,
    client_factory,
)


@pytest.fixture()
def anon_client(rpt_engine, monkeypatch):  # noqa: F811
    """A client wired to the scratch DB but holding NO app-session cookie
    — the default-deny gate should 401 every /api/comments call before a
    handler runs (T-COM-112)."""
    from app import db as app_db

    monkeypatch.setattr(app_db, "get_engine", lambda: rpt_engine)
    client = TestClient(create_app(), base_url="https://testserver")
    client.__enter__()
    yield client
    client.__exit__(None, None, None)