"""EH-09 — actionable error-message hints are pinned by substring so they can't
silently rot. mgf-fastapi raises HttpError-family exceptions at its auth/allowlist
seams; each carries a stable, human-actionable message.
"""

from __future__ import annotations

import inspect

import mgf.fastapi.security as security

# (substring that MUST remain in the source's raised messages). If a refactor
# changes the wording, update BOTH the source and this pin deliberately.
_REQUIRED_HINTS = (
    "client IP not in allowlist",
    "missing bearer token",
    "authentication not configured",
    "invalid or expired session",
)


def test_security_messages_are_stable() -> None:
    src = inspect.getsource(security)
    missing = [h for h in _REQUIRED_HINTS if h not in src]
    assert not missing, (
        f"EH-09: actionable hint(s) changed/removed without updating the pin: {missing}"
    )
