import ssl
from pathlib import Path

import certifi

from apps.sources.services.tls import trusted_tls_context


def test_application_tls_context_uses_strict_pinned_ca_bundle():
    context = trusted_tls_context()

    assert Path(certifi.where()).is_file()
    assert context.verify_mode == ssl.CERT_REQUIRED
    assert context.check_hostname is True
    assert context.cert_store_stats()["x509_ca"] > 0