"""中间件注册顺序：限流须在 DB 会话/操作日志之外（更外层），
否则被限流的请求仍先开 DB 会话、仍写操作日志，DoS 时放大 DB 与日志负担。"""
from core.app import create_app


def _middleware_names(app):
    """按执行顺序（列表最前 = 最外层/先执行）提取各中间件名。"""
    names = []
    for m in app.user_middleware:
        dispatch = getattr(m, 'kwargs', {}).get('dispatch')
        if dispatch is not None:
            names.append(getattr(dispatch, '__name__', str(dispatch)))
        else:
            names.append(getattr(m.cls, '__name__', str(m)))
    return names


def test_rate_limit_runs_before_db_session_and_operation_log():
    names = _middleware_names(create_app())
    # 限流必须比 DB 会话 / 操作日志更外层（先执行），拒绝请求不进入 DB 与日志
    assert 'rate_limit_middleware' in names
    assert names.index('rate_limit_middleware') < names.index('db_session_middleware')
    assert names.index('rate_limit_middleware') < names.index('operation_log_middleware')


def test_cors_is_outermost():
    names = _middleware_names(create_app())
    # CORS 在最外层，直接返回的响应也带 CORS 头
    assert 'CORSMiddleware' in names
    assert names.index('CORSMiddleware') == 0