# retoor <retoor@molodetz.nl>


def test_tables_requires_auth(client):
    assert client.get("/dbapi/tables").status_code == 403


def test_tables_lists_and_hides_denied(client, auth):
    response = client.get("/dbapi/tables", headers=auth)
    assert response.status_code == 200
    names = {row["name"] for row in response.json()["tables"]}
    assert "users" in names
    assert "sessions" not in names
    assert "password_resets" not in names


def test_schema(client, auth):
    response = client.get("/dbapi/users/schema", headers=auth)
    assert response.status_code == 200
    assert any(column["name"] == "uid" for column in response.json()["columns"])


def test_schema_denied_table_is_404(client, auth):
    assert client.get("/dbapi/sessions/schema", headers=auth).status_code == 404
