import pytest

from integrations.mcp import server as mcp_server
from security.auth.api_keys import ResolvedAPIKey


def test_mcp_bind_norms_tool_removed():
    assert not hasattr(mcp_server, "bind_norms")


@pytest.mark.asyncio
async def test_mcp_check_action_compliance_forwards_identity(monkeypatch):
    async def _fake_auth(_caller_api_key):
        return ResolvedAPIKey(
            key_id="kid-1",
            agent_id="agent-1",
            scopes=["*"],
            is_active=True,
            expires_at=None,
        )

    captured = {}

    async def _fake_check_action_compliance(**kwargs):
        captured.update(kwargs)
        return {"compliant": False, "violations": [{"message": "x"}]}

    monkeypatch.setattr(mcp_server, "_require_auth", _fake_auth)
    monkeypatch.setattr(
        mcp_server.clients,
        "check_action_compliance",
        _fake_check_action_compliance,
    )

    result = await mcp_server.check_action_compliance(
        action_description="export raw pii",
        norm_ids=["11111111-1111-1111-1111-111111111111"],
        caller_api_key="ak_test",
    )

    assert result["compliant"] is False
    assert captured["agent_id"] == "agent-1"
    assert captured["key_id"] == "kid-1"
    assert captured["action_description"] == "export raw pii"


@pytest.mark.asyncio
async def test_mcp_report_norm_outcome_forwards_payload(monkeypatch):
    async def _fake_auth(_caller_api_key):
        return ResolvedAPIKey(
            key_id="kid-2",
            agent_id="agent-2",
            scopes=["*"],
            is_active=True,
            expires_at=None,
        )

    captured = {}

    async def _fake_report_norm_outcome(**kwargs):
        captured.update(kwargs)
        return {
            "id": "11111111-1111-1111-1111-111111111111",
            "usage_token": kwargs["usage_token"],
            "norm_id": kwargs["norm_id"],
            "outcome": kwargs["outcome"],
            "created_at": "2026-03-11T00:00:00Z",
        }

    monkeypatch.setattr(mcp_server, "_require_auth", _fake_auth)
    monkeypatch.setattr(
        mcp_server.clients,
        "report_norm_outcome",
        _fake_report_norm_outcome,
    )

    result = await mcp_server.report_norm_outcome(
        usage_token="ut-abc",
        norm_id="22222222-2222-2222-2222-222222222222",
        outcome="complied",
        details={"why": "rule satisfied"},
        caller_api_key="ak_test",
    )

    assert result["usage_token"] == "ut-abc"
    assert captured["agent_id"] == "agent-2"
    assert captured["details"] == {"why": "rule satisfied"}


@pytest.mark.asyncio
async def test_mcp_get_traces_requires_scope(monkeypatch):
    async def _fake_auth(_caller_api_key):
        return ResolvedAPIKey(
            key_id="kid-3",
            agent_id="agent-3",
            scopes=["norms:retrieve"],
            is_active=True,
            expires_at=None,
        )

    monkeypatch.setattr(mcp_server, "_require_auth", _fake_auth)

    with pytest.raises(PermissionError):
        await mcp_server.get_traces(
            agent_id="agent-3",
            caller_api_key="ak_test",
        )
