"""Discovery must describe actual public capabilities."""
import pytest
from fastapi.testclient import TestClient
from src.core.agent_auth import build_auth_md
from src.main import app


@pytest.mark.parametrize("path", [
    "/.well-known/oauth-protected-resource",
    "/.well-known/oauth-authorization-server",
    "/.well-known/openid-configuration",
    "/.well-known/jwks.json",
])
@pytest.mark.parametrize("method", ["GET", "HEAD"])
def test_unsupported_auth_protocols_are_not_published(path, method):
    assert TestClient(app).request(method, path).status_code == 404


def test_auth_md_describes_dashboard_session_not_token_provisioning():
    markdown = build_auth_md("https://dashboard.p2hs.com")
    assert markdown.startswith("# auth.md")
    assert "https://dashboard.p2hs.com/login" in markdown
    assert "not OAuth authorization/token endpoints" in markdown
    assert "must not expect raw access or refresh tokens" in markdown
    assert "beapipie" not in markdown


def test_auth_md_uses_configured_public_origin_not_host_header():
    from src.config import get_settings
    client = TestClient(app, base_url="https://private-core.invalid")
    response = client.get("/auth.md")
    assert response.status_code == 200
    assert get_settings().app_url.rstrip("/") in response.text
    assert "private-core.invalid" not in response.text
    assert response.headers["content-type"].startswith("text/markdown")
    assert client.head("/auth.md").content == b""