import time


def test_security_headers_present(client):
    response = client.get("/")
    assert response.status_code == 200
    assert response.headers.get("x-content-type-options") == "nosniff"
    assert "cache-control" in response.headers


def test_api_runtime_budget_smoke(client, seeded_news):
    start = time.monotonic()
    response = client.get("/api/news?limit=10&language=en")
    elapsed = time.monotonic() - start
    assert response.status_code == 200
    assert elapsed < 0.8