"""DCR (POST /api/agent-access/clients) is the one endpoint where logging the
exact request-validation failure is safe (public OAuth client metadata, never
a user secret) and genuinely needed for debugging real-world client payloads."""
from types import SimpleNamespace

import structlog.testing
from fastapi.testclient import TestClient
from src.main import app


def test_dcr_validation_failure_is_logged_without_changing_the_client_response(monkeypatch):
    monkeypatch.setattr(
        "src.domain.agent_access.dependencies.get_settings",
        lambda: SimpleNamespace(agent_access_enabled=True, agent_proxy_secret="proxy-secret"),
    )
    client = TestClient(app)
    with structlog.testing.capture_logs() as logs:
        response = client.post(
            "/api/agent-access/clients",
            headers={"X-P2HS-Agent-Proxy": "proxy-secret"},
            json={"client_name": "Claude", "redirect_uris": ["not-a-valid-uri"]},
        )
    assert response.status_code == 422
    assert response.json()["detail"]  # default FastAPI shape, unchanged
    [event] = [log for log in logs if log["event"] == "request_validation_failed"]
    assert event["path"] == "/api/agent-access/clients"
    assert any("redirect_uris" in str(err.get("loc")) for err in event["errors"])