"""Le routage cote client doit rester fonctionnel derriere FastAPI."""

from fastapi.testclient import TestClient


def test_share_route_falls_back_to_spa(client: TestClient) -> None:
    response = client.get("/s/un-token-quelconque")
    assert response.status_code == 200
    assert "text/html" in response.headers["content-type"]


def test_root_route_is_served(client: TestClient) -> None:
    response = client.get("/")
    assert response.status_code == 200
    assert "text/html" in response.headers["content-type"]


def test_path_traversal_is_blocked(client: TestClient) -> None:
    response = client.get("/../../etc/passwd")
    # Soit 404, soit repli SPA : dans tous les cas jamais le contenu du fichier.
    assert response.status_code in (200, 404)
    assert "root:" not in response.text