"""Discovery remains usable behind ingress that forwards only /api/* to Core."""

import pytest
from fastapi.testclient import TestClient
from src.config import get_settings
from src.main import app


@pytest.mark.parametrize("public_path,alias", [
    ("/.well-known/api-catalog", "/api/discovery/api-catalog"),
    ("/auth.md", "/api/discovery/auth.md"),
    ("/public-openapi.json", "/api/discovery/public-openapi.json"),
    ("/health", "/api/discovery/health"),
])
def test_discovery_alias_preserves_public_document(public_path, alias):
    client = TestClient(app, base_url="https://private-core.invalid")
    expected = client.get(public_path)
    response = client.get(alias)
    assert expected.status_code == response.status_code == 200
    assert response.content == expected.content
    assert response.headers["content-type"] == expected.headers["content-type"]
    if public_path == "/health":
        body = response.json()
        assert body["status"] == "ok"
        assert isinstance(body.get("git_sha"), str)
        assert len(body["git_sha"]) == 40
    assert "private-core.invalid" not in response.text
    assert "/api/discovery/" not in response.text
    head = client.head(alias)
    assert head.status_code == 200
    assert head.content == b""


@pytest.mark.parametrize("name", ["oauth-authorization-server", "agent-card.json"])
def test_agent_alias_preserves_proxy_guard_and_canonical_identity(monkeypatch, name):
    settings = get_settings()
    monkeypatch.setattr("src.domain.agent_access.dependencies.get_settings", lambda: settings)
    monkeypatch.setattr("src.domain.agent_access.discovery.get_settings", lambda: settings)
    monkeypatch.setattr(settings, "agent_access_enabled", True)
    monkeypatch.setattr(settings, "agent_proxy_secret", "test-proxy-secret")
    monkeypatch.setattr(settings, "app_url", "https://dashboard.p2hs.com")
    client = TestClient(app, base_url="https://private-core.invalid")
    alias = f"/api/discovery/{name}"
    assert client.get(alias).status_code == 404
    assert client.get(alias, headers={"X-P2HS-Agent-Proxy": "wrong"}).status_code == 404
    headers = {"X-P2HS-Agent-Proxy": "test-proxy-secret"}
    response = client.get(alias, headers=headers)
    assert response.status_code == 200
    assert response.json() == client.get(f"/.well-known/{name}", headers=headers).json()
    assert "private-core.invalid" not in response.text
    assert "/api/discovery/" not in response.text
    if name == "oauth-authorization-server":
        assert response.json()["issuer"] == "https://dashboard.p2hs.com"
        # Only "none" is real for self-service DCR clients (ClientCreate is
        # Literal["none"]); advertising "client_secret_post" here makes a real
        # client (e.g. Claude) request it and get a 422 from /clients.
        assert response.json()["token_endpoint_auth_methods_supported"] == ["none"]
    monkeypatch.setattr(settings, "agent_access_enabled", False)
    assert client.get(alias, headers=headers).status_code == 404