//! `spectra agent allow` (spec §8.4): the owner lets one agent post in

//! another project's channel, and can take it back; an agent cannot grant

//! itself anything.

mod common;

use common::{run, setup, text, Serving};

use serde_json::{json, Value};

use spectra_core::keys::KeyPair;

use spectra_mcp::client::{rpc_result, Client};

async fn say(c: &Client, channel: &str) -> Value {

    let req = json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "say", "arguments": { "body": format!("hello {channel}"), "channel": channel } } });

    rpc_result(&c.mcp("2025-11-25", &req).await.unwrap()).unwrap()["result"].clone()

}

#[tokio::test]

async fn the_owner_opens_one_channel_to_one_agent() {

    let dir = setup();

    let d = dir.path();

    assert!(run(d, &["project", "add", "bubblebobble"]).status.success());

    let home = d.join("agents/claude-mg");

    let o =

        run(d, &["agent", "add", "claude-mg", "--kind", "claude-code", "--project", "oxygen", "--home", home.to_str().unwrap(), "--yes"]);

    assert!(o.status.success(), "{}", text(&o));

    let srv = Serving::start(d);

    let c = Client::new(&srv.socket, Some(KeyPair::load_home(&home).unwrap()));

    let r = say(&c, "bubblebobble").await;

    assert_eq!(r["isError"], true);

    assert!(r["content"][0]["text"].as_str().unwrap().contains("spectra agent allow NAME --channel bubblebobble"), "{r}");

    let o = run(d, &["agent", "allow", "claude-mg", "--channel", "#bubblebobble"]);

    assert!(o.status.success(), "{}", text(&o));

    let listed: Value = serde_json::from_slice(&run(d, &["agent", "list", "--json"]).stdout).unwrap();

    let mg = listed.as_array().unwrap().iter().find(|a| a["name"] == "claude-mg").unwrap();

    assert_eq!(mg["channels"], json!(["bubblebobble"]), "the API reports the grant: {mg}");

    assert_eq!(say(&c, "bubblebobble").await["isError"], false, "allowed");

    assert_eq!(say(&c, "oxygen").await["isError"], false, "its own channel still");

    assert!(run(d, &["agent", "allow", "claude-mg", "--channel", "bubblebobble", "--remove"]).status.success());

    assert_eq!(say(&c, "bubblebobble").await["isError"], true, "taken back");

    assert!(!run(d, &["agent", "allow", "claude-mg", "--channel", "Not A Channel"]).status.success());

    // An agent cannot grant itself: its key signing agent.scoped fails verify.

    let me = KeyPair::load_home(&home).unwrap();

    let forged = spectra_core::principals::signed_event(

        &me,

        "agent:claude-mg",

        "agent.scoped",

        json!({ "name": "claude-mg", "scope": "projects:all" }),

    );

    let w = spectra_core::daemon::WireEvent::from_new(&forged);

    let r = c.send("POST", "/api/v1/ledger/events", &[], serde_json::to_vec(&vec![w]).unwrap()).await.unwrap();

    assert_eq!(r.status, 403, "{}", String::from_utf8_lossy(&r.body));

    assert_eq!(say(&c, "bubblebobble").await["isError"], true);

    srv.stop();

    for args in [["admin", "verify"], ["admin", "check"], ["admin", "rebuild"]] {

        let o = run(d, &args);

        assert!(o.status.success(), "{args:?}: {}", text(&o));

    }

}