"""What the MCP tools send, whatever an agent hands them."""

import asyncio

import httpx

from fluksio.mcp import server


def test_a_name_cannot_climb_out_of_its_route() -> None:
    """httpx resolves ``..``, so ``save_flow("../ai/config")`` was ``PUT /ai/config``.

    A prompt-injected assistant acting for a superuser could repoint the
    provider that way while the stored key stayed.
    """
    seen: list[str] = []

    def record(request: httpx.Request) -> httpx.Response:
        seen.append(f"{request.method} {request.url.raw_path.decode()}")
        return httpx.Response(200, json={})

    async def calls() -> None:
        previous = server._client
        mock = httpx.AsyncClient(
            transport=httpx.MockTransport(record), base_url="http://test"
        )
        server.set_client(mock)
        try:
            await server.save_flow("../ai/config", {})
            await server.delete_flow("..")
            await server.get_node_source("..", "../source")
        finally:
            server.set_client(previous)
            await mock.aclose()

    asyncio.run(calls())
    assert seen == [
        "PUT /api/v1/flows/%2E%2E%2Fai%2Fconfig",
        "DELETE /api/v1/flows/%2E%2E",
        "GET /api/v1/flows/%2E%2E/nodes/%2E%2E%2Fsource/source",
    ]


def test_the_assistant_calls_a_tool_as_the_person_chatting() -> None:
    """The in-process path: no MCP request, so the person's token is set by hand."""
    from fluksio.ai import agent

    seen: list[str | None] = []

    def record(request: httpx.Request) -> httpx.Response:
        seen.append(request.headers.get("authorization"))
        return httpx.Response(200, json=[{"name": "home"}])

    async def calls() -> tuple[list[dict], str]:
        previous = server._client
        mock = httpx.AsyncClient(
            transport=httpx.MockTransport(record),
            base_url="http://test",
            event_hooks={"request": [server.forward_caller_auth]},
        )
        server.set_client(mock)
        try:
            specs = await agent.tool_specs()
            answer = await agent.mcp_caller("Bearer person")("list_flows", {})
        finally:
            server.set_client(previous)
            await mock.aclose()
        return specs, answer

    specs, answer = asyncio.run(calls())
    assert {"list_flows", "run_flow"} <= {s["function"]["name"] for s in specs}
    assert all(s["function"]["parameters"]["type"] == "object" for s in specs)
    assert seen == ["Bearer person"]
    assert "home" in answer