From 0b520b5d37b0a951523f12b635a2361f862e89bf Mon Sep 17 00:00:00 2001
From: Sabrina Tso <316314148+SabrinaTso@users.noreply.github.com>
Date: Sun, 23 Aug 2026 04:53:53 +0800
Subject: [PATCH] test: cover middleware on composed app

---
 tests/test_app_middleware.py | 42 ++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 tests/test_app_middleware.py

diff --git a/tests/test_app_middleware.py b/tests/test_app_middleware.py
new file mode 100644
index 0000000..9034621
--- /dev/null
+++ b/tests/test_app_middleware.py
@@ -0,0 +1,42 @@
+"""Regression tests for middleware on the public composed ASGI application."""
+
+import pytest
+from httpx import ASGITransport, AsyncClient
+
+from data_api.api.api import app
+
+
+class TestPublicAppMiddleware:
+    """The exported application must retain middleware configured for the REST API."""
+
+    @pytest.fixture
+    async def client(self):
+        """Create an in-process client for the publicly exported ASGI application."""
+        async with AsyncClient(
+            transport=ASGITransport(app=app), base_url="http://test", follow_redirects=True
+        ) as client:
+            yield client
+
+    async def test_public_app_answers_cors_preflight_requests(self, client: AsyncClient):
+        """Browser clients can preflight a public API request from an allowed origin."""
+        response = await client.options(
+            "/openapi.json",
+            headers={
+                "Origin": "https://consumer.example",
+                "Access-Control-Request-Method": "GET",
+            },
+        )
+
+        assert response.status_code == 200
+        assert response.headers["access-control-allow-origin"] == "*"
+        assert "GET" in response.headers["access-control-allow-methods"]
+
+    async def test_public_app_keeps_cors_and_process_time_on_api_responses(
+        self, client: AsyncClient
+    ):
+        """The composed app keeps CORS and timing middleware on actual API responses."""
+        response = await client.get("/openapi.json", headers={"Origin": "https://consumer.example"})
+
+        assert response.status_code == 200
+        assert response.headers["access-control-allow-origin"] == "*"
+        assert float(response.headers["x-process-time"]) >= 0