"""API tests for user routes (thin handlers → services)."""

from __future__ import annotations

import pytest


@pytest.mark.skip(reason="requires DB fixture; wire up after issue #2 (project-status compat)")
async def test_list_users(client) -> None:
    """GET /api/v1/users returns a list of users."""
    response = await client.get("/api/v1/users")
    assert response.status_code == 200
    assert isinstance(response.json(), list)


@pytest.mark.skip(reason="requires DB fixture; wire up after issue #2 (project-status compat)")
async def test_ip_whitelist_blocks(client) -> None:
    """Non-whitelisted IPs must get 403."""
    response = await client.get("/api/v1/users", headers={"X-Forwarded-For": "10.0.0.1"})
    assert response.status_code == 403