package pier_test

import (
	"context"
	"net/http"
	"slices"
	"testing"
	"time"

	"git.golem15.com/golem15/summercms/modules/pact"
)

// setGrant replaces (or adds) the grant a fake verifier answers for raw.
func (v *fakeVerifier) setGrant(raw string, g pact.MCPGrant) {
	v.mu.Lock()
	v.grants[raw] = g
	v.mu.Unlock()
}

// TestScopeWidening pins plan 06's re-filtering of a returning binding
// (A-WR-04, P-26): a binding first seen with read and then with read write
// lists the write tool on its next request, on the stateless and on the
// stateful path; a backend subject added to the binding (the grant gains
// backend, the user is linked) adds the backend tools without any fan-out
// event; and a narrowed grant hides the tools again.
func TestScopeWidening(t *testing.T) {
	links := newFakeLinks()
	links.set(11, 42)
	verifier := newFakeVerifier(nil)
	front := &fakeGuard{}
	back := &fakeGuard{name: "backend", tokenMW: "backend"}
	acme := routePlugin{id: "test.acme",
		routes: []testRoute{guarded(http.MethodPost, "/acme/echo/{id}"), guarded(http.MethodGet, "/acme/items/{id}")},
		tools: []pact.MCPTool{
			{Name: "echo", Method: "POST", Path: "/acme/echo/{id}", Input: echoInput{}},
			{Name: "show", Method: "GET", Path: "/acme/items/{id}", Input: showInput{}},
		}}
	office := routePlugin{id: "test.office", guard: "backend", middleware: "backend",
		routes: []testRoute{{method: http.MethodGet, path: "/office/posts", mw: []string{"backend"}, h: noContent}},
		tools:  []pact.MCPTool{{Name: "posts", Method: "GET", Path: "/office/posts", Input: struct{}{}}}}
	in := startInstance(t, newApp(t, appSpec{
		mcp:      "enabled: false\nsessions:\n  store: memory\n",
		guards:   []pact.MCPGuard{front, back},
		verifier: verifier,
		links:    links,
	}), acme, office)
	t.Cleanup(in.pier().StopReaper)

	readOnly := []string{"acme_show"}
	readWrite := []string{"acme_echo", "acme_show"}
	withBackend := []string{"acme_echo", "acme_show", "office_posts"}

	for _, path := range []struct {
		name    string
		version string
		token   string
		client  string
	}{
		{"stateless", "newest", "oas_at_wide_stateless", "c5"},
		{"stateful", "", "oas_at_wide_stateful", "c6"},
	} {
		t.Run(path.name, func(t *testing.T) {
			ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
			defer cancel()
			verifier.setGrant(path.token, grant(11, path.client, 11, "read"))
			cs := sdkClient(t, ctx, in.url(), path.token, clientOpts{version: path.version})
			if (cs.ID() == "") != (path.name == "stateless") {
				t.Fatalf("%s client session id %q", path.name, cs.ID())
			}
			if got := listNames(t, ctx, cs); !slices.Equal(got, readOnly) {
				t.Fatalf("read grant lists %v", got)
			}

			verifier.setGrant(path.token, grant(11, path.client, 11, "read", "write"))
			if got := listNames(t, ctx, cs); !slices.Equal(got, readWrite) {
				t.Fatalf("after widening to read write: %v", got)
			}

			// The same binding returns with the backend scope; the user is
			// linked, so a backend subject joins the identity. No event is
			// fired: the request itself re-filters the cached server.
			verifier.setGrant(path.token, grant(11, path.client, 11, "read", "write", "backend"))
			if got := listNames(t, ctx, cs); !slices.Equal(got, withBackend) {
				t.Fatalf("after adding the backend subject: %v", got)
			}

			verifier.setGrant(path.token, grant(11, path.client, 11, "read"))
			if got := listNames(t, ctx, cs); !slices.Equal(got, readOnly) {
				t.Fatalf("after narrowing to read: %v", got)
			}
		})
	}
}