Test the API with AI-written tests

Write pytest tests for my FastAPI order API.

Setup rules:
- Use fastapi.testclient.TestClient.
- Create tests/conftest.py with a fixture `client` that builds a fresh in-memory SQLite database for every test (sqlalchemy StaticPool, check_same_thread=False), creates the tables with Base.metadata.create_all, and overrides the get_db dependency with app.dependency_overrides. The fixture must set the ADMIN_KEY environment variable with monkeypatch. Never touch brew.db.
- Add fixtures `admin` (headers dict) and `valid_order` (a valid request body).
- Put the tests in tests/test_api.py. Use pytest.mark.parametrize where many inputs share one expectation.
- Test every rule and status code in the contract, not only the happy path. Every test needs at least one specific assert on a value (not just a status code where a value matters).
- Do not change the app code. If you think the app has a bug, tell me instead.

Contract:
[paste API.md]

App code:
[paste app/main.py, app/schemas.py and app/db.py]

import pytest
from fastapi.testclient import TestClient
from sqlalchemy import create_engine
from sqlalchemy.orm import sessionmaker
from sqlalchemy.pool import StaticPool

from app.db import Base, get_db
from app.main import app

ADMIN_KEY = "test-admin-key"


@pytest.fixture()
def client(monkeypatch):
    """A client that talks to a fresh, empty database for every test."""
    monkeypatch.setenv("ADMIN_KEY", ADMIN_KEY)

    # One in-memory SQLite database, shared by every connection in this test.
    engine = create_engine(
        "sqlite://",
        connect_args={"check_same_thread": False},
        poolclass=StaticPool,
    )
    Base.metadata.create_all(engine)
    TestingSession = sessionmaker(bind=engine, autoflush=False)

    def override_get_db():
        db = TestingSession()
        try:
            yield db
        finally:
            db.close()

    app.dependency_overrides[get_db] = override_get_db
    yield TestClient(app)
    app.dependency_overrides.clear()
    engine.dispose()


@pytest.fixture()
def admin():
    return {"X-Admin-Key": ADMIN_KEY}


@pytest.fixture()
def valid_order():
    return {
        "customer_name": "Asha",
        "phone": "9876543210",
        "items": [
            {"item_id": "espresso", "qty": 2},
            {"item_id": "croissant", "qty": 1},
        ],
        "pickup": "in_15",
    }

from datetime import datetime, timezone

import pytest


def place(client, order):
    response = client.post("/orders", json=order)
    assert response.status_code == 201
    return response.json()


# ---- GET /menu -------------------------------------------------------------

def test_menu_returns_all_eight_items(client):
    response = client.get("/menu")
    assert response.status_code == 200
    menu = response.json()
    assert len(menu) == 8
    prices = {item["id"]: item["price"] for item in menu}
    assert prices["espresso"] == 120
    assert prices["filter-coffee"] == 80


# ---- POST /orders ----------------------------------------------------------

def test_create_order_computes_total_on_the_server(client, valid_order):
    order = place(client, valid_order)
    # 2 x Espresso (120) + 1 x Butter Croissant (150)
    assert order["total"] == 390
    assert order["status"] == "received"
    assert order["customer_name"] == "Asha"
    assert order["items"][0] == {
        "item_id": "espresso", "name": "Espresso", "price": 120, "qty": 2,
    }


def test_client_cannot_set_the_price_or_status(client, valid_order):
    valid_order["total"] = 1
    valid_order["status"] = "picked_up"
    valid_order["items"][0]["price"] = 1
    order = place(client, valid_order)
    assert order["total"] == 390
    assert order["status"] == "received"


def test_pickup_time_is_in_the_future_and_has_a_timezone(client, valid_order):
    order = place(client, valid_order)
    pickup = datetime.fromisoformat(order["pickup_time"])
    assert pickup.tzinfo is not None
    assert pickup > datetime.now(timezone.utc)


def test_name_is_trimmed(client, valid_order):
    valid_order["customer_name"] = "  Asha  "
    assert place(client, valid_order)["customer_name"] == "Asha"


@pytest.mark.parametrize(
    "change",
    [
        {"phone": "12345"},
        {"phone": "5876543210"},          # must start with 6, 7, 8 or 9
        {"phone": "98765 43210"},
        {"customer_name": "A"},
        {"customer_name": "   "},
        {"items": []},
        {"items": [{"item_id": "espresso", "qty": 0}]},
        {"items": [{"item_id": "espresso", "qty": 21}]},
        {"items": [{"item_id": "espresso", "qty": 1},
                   {"item_id": "espresso", "qty": 1}]},
        {"pickup": "tomorrow"},
    ],
)
def test_bad_orders_are_rejected(client, valid_order, change):
    valid_order.update(change)
    assert client.post("/orders", json=valid_order).status_code == 422


def test_unknown_menu_item_is_rejected(client, valid_order):
    valid_order["items"] = [{"item_id": "pizza", "qty": 1}]
    response = client.post("/orders", json=valid_order)
    assert response.status_code == 422
    assert "pizza" in response.json()["detail"]


# ---- GET /orders/{id} ------------------------------------------------------

def test_get_order_returns_what_was_saved(client, valid_order):
    created = place(client, valid_order)
    response = client.get(f"/orders/{created['id']}")
    assert response.status_code == 200
    assert response.json() == created


def test_get_unknown_order_is_404(client):
    assert client.get("/orders/does-not-exist").status_code == 404


# ---- PATCH /orders/{id}/status ---------------------------------------------

def test_status_changes_need_the_admin_key(client, valid_order):
    order = place(client, valid_order)
    url = f"/orders/{order['id']}/status"
    body = {"status": "preparing"}
    assert client.patch(url, json=body).status_code == 401
    assert client.patch(url, json=body, headers={"X-Admin-Key": "wrong"}).status_code == 401


def test_status_moves_through_the_whole_flow(client, valid_order, admin):
    order = place(client, valid_order)
    url = f"/orders/{order['id']}/status"
    for status in ["preparing", "ready", "picked_up"]:
        response = client.patch(url, json={"status": status}, headers=admin)
        assert response.status_code == 200
        assert response.json()["status"] == status
    assert client.get(f"/orders/{order['id']}").json()["status"] == "picked_up"


@pytest.mark.parametrize(
    "path, bad_next",
    [
        ([], "ready"),                       # cannot skip "preparing"
        ([], "picked_up"),
        (["preparing", "ready"], "cancelled"),  # too late to cancel
        (["cancelled"], "preparing"),        # cancelled is final
    ],
)
def test_invalid_status_moves_are_409(client, valid_order, admin, path, bad_next):
    order = place(client, valid_order)
    url = f"/orders/{order['id']}/status"
    for status in path:
        assert client.patch(url, json={"status": status}, headers=admin).status_code == 200
    response = client.patch(url, json={"status": bad_next}, headers=admin)
    assert response.status_code == 409


def test_unknown_status_value_is_422(client, valid_order, admin):
    order = place(client, valid_order)
    response = client.patch(
        f"/orders/{order['id']}/status", json={"status": "teleported"}, headers=admin
    )
    assert response.status_code == 422


def test_status_update_for_unknown_order_is_404(client, admin):
    response = client.patch(
        "/orders/nope/status", json={"status": "preparing"}, headers=admin
    )
    assert response.status_code == 404


def test_server_without_admin_key_refuses_changes(client, valid_order, monkeypatch):
    order = place(client, valid_order)
    monkeypatch.delenv("ADMIN_KEY")
    response = client.patch(
        f"/orders/{order['id']}/status",
        json={"status": "preparing"},
        headers={"X-Admin-Key": "anything"},
    )
    assert response.status_code == 503

pytest

A pytest test fails. Explain in simple words why it fails, and tell me whether the bug is more likely in the test or in the app code. Do not change anything yet.

Contract rule:
[paste the rule from API.md]

Test:
[paste the test]

App code involved:
[paste the function]

Failure output:
[paste the pytest output]