import pytest

from karldns.settings import _is_reserved_admin_path, _validate_launch_secrets


def test_reserved_admin_path_matches_exact_and_nested_public_routes() -> None:
    assert _is_reserved_admin_path("/api")
    assert _is_reserved_admin_path("/api/v1")
    assert _is_reserved_admin_path("/logo.png")
    assert _is_reserved_admin_path("/llms.txt")
    assert not _is_reserved_admin_path("/ops")
    assert not _is_reserved_admin_path("/apix")


def test_launch_secrets_require_strong_admin_password() -> None:
    with pytest.raises(RuntimeError, match="DDNS_ADMIN_PASSWORD"):
        _validate_launch_secrets("short", "")