#!/usr/bin/env python3
"""API security smoke tests for authorized endpoints.

Provide a small YAML-like JSON test plan. The script checks expected status codes
for authentication, method handling, and schema validation cases.
"""

from __future__ import annotations

import argparse
import json
from pathlib import Path

import requests


def run_case(base_url: str, case: dict[str, object]) -> bool:
    method = str(case.get("method", "GET")).upper()
    path = str(case["path"])
    expected = int(case.get("expected_status", 200))
    headers = dict(case.get("headers", {}))
    body = case.get("json")
    response = requests.request(method, base_url.rstrip("/") + path, headers=headers, json=body, timeout=10)
    ok = response.status_code == expected
    print(f"{'PASS' if ok else 'FAIL'} {method} {path}: got {response.status_code}, expected {expected}")
    return ok


def main() -> int:
    parser = argparse.ArgumentParser(description="Run authorized API security test templates.")
    parser.add_argument("base_url")
    parser.add_argument("plan", type=Path)
    args = parser.parse_args()
    plan = json.loads(args.plan.read_text(encoding="utf-8"))
    results = [run_case(args.base_url, case) for case in plan["cases"]]
    return 0 if all(results) else 1


if __name__ == "__main__":
    raise SystemExit(main())