# retoor <retoor@molodetz.nl>


def test_api_key_header(admin, anon):
    key = admin.get("/profile/api-key", headers={"Accept": "application/json"}).json()["api_key"]
    assert anon.get("/admin", headers={"X-API-KEY": key, "Accept": "application/json"}).status_code == 200
    assert anon.get("/admin", headers={"Authorization": f"Bearer {key}", "Accept": "application/json"}).status_code == 200


def test_no_jwt_anywhere(admin):
    response = admin.get("/profile/api-key", headers={"Accept": "application/json"})
    assert response.json()["api_key"].count(".") == 0