from modelforge_api.settings import Settings


def test_security_sensitive_defaults() -> None:
    settings = Settings(_env_file=None)
    assert settings.allow_remote_code is False
    assert settings.gateway_max_payload_bytes == 65_536
    assert settings.node_agent_max_payload_bytes == 4_194_304
    assert settings.control_plane_max_payload_bytes == 1_048_576


def test_cors_configuration_parsing() -> None:
    settings = Settings(_env_file=None, cors_origins="http://one.test, http://two.test")
    assert settings.cors_origin_list == ["http://one.test", "http://two.test"]