//! `spectra serve` end to end (spec §8.5, §15.1): the real binary, a client
//! signing requests over the Unix socket, both MCP revisions, and every
//! refusal the spec promises. Hermetic: temporary homes, data and port 0.

mod common;

use common::{add_agent, run, setup, text, Serving};
use serde_json::json;
use spectra_core::keys::KeyPair;
use spectra_mcp::client::{rpc_result, Client};

fn call(id: u64, name: &str, args: serde_json::Value) -> serde_json::Value {
    json!({ "jsonrpc": "2.0", "id": id, "method": "tools/call", "params": { "name": name, "arguments": args,
        "_meta": { "io.modelcontextprotocol/protocolVersion": "2026-07-28" } } })
}

#[tokio::test]
async fn an_agent_discovers_lists_and_calls_tools_over_the_socket() {
    let dir = setup();
    let d = dir.path();
    let agent = add_agent(d, "claude-oxygen", &[]);
    let srv = Serving::start(d);
    let c = Client::new(&srv.socket, Some(agent.clone()));

    let r = c.mcp("2026-07-28", &json!({ "jsonrpc": "2.0", "id": 1, "method": "server/discover", "params": {} })).await.unwrap();
    assert_eq!(r.status, 200, "{}", String::from_utf8_lossy(&r.body));
    let v = r.json().unwrap();
    assert_eq!(v["result"]["serverInfo"]["name"], "spectra");
    assert_eq!(v["result"]["resultType"], "complete");
    assert!(v["result"]["supportedVersions"].as_array().unwrap().contains(&json!("2025-11-25")));

    let v = c.mcp("2026-07-28", &json!({ "jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {} })).await.unwrap().json().unwrap();
    assert!(v["result"]["tools"].as_array().unwrap().iter().any(|t| t["name"] == "agents"));
    assert_eq!(v["result"]["ttlMs"], 3_600_000);
    assert!(v["result"]["_meta"]["spectra/session"].is_string(), "{v}");

    let r = c.mcp("2026-07-28", &call(3, "agents", json!({}))).await.unwrap();
    let v = rpc_result(&r).unwrap();
    assert_eq!(v["result"]["isError"], false, "{v}");
    assert_eq!(v["result"]["structuredContent"]["agents"][0]["owner"], "Andy McCall");
    assert!(v["result"]["content"][0]["text"].as_str().unwrap().contains("claude-oxygen · Andy McCall's agent"));

    // The legacy revisions begin with initialize.
    let v = c.mcp("2025-11-25", &json!({ "jsonrpc": "2.0", "id": 4, "method": "initialize", "params": { "protocolVersion": "2025-11-25", "capabilities": {}, "clientInfo": { "name": "t", "version": "1" } } })).await.unwrap().json().unwrap();
    assert_eq!(v["result"]["protocolVersion"], "2025-11-25");
    assert!(v["result"]["instructions"].as_str().unwrap().contains("Call `brief` first"));
    assert_eq!(c.mcp("2025-11-25", &json!({ "jsonrpc": "2.0", "method": "notifications/initialized" })).await.unwrap().status, 202);
    srv.stop();
}

#[tokio::test]
async fn every_refusal_the_spec_promises() {
    let dir = setup();
    let d = dir.path();
    let agent = add_agent(d, "claude-oxygen", &[]);
    let uid = unsafe { libc::getuid() };
    let other_uid = (uid + 1).to_string();
    let bound = add_agent(d, "bound", &["--uid", &other_uid]);
    let srv = Serving::start(d);
    let list = json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": { "_meta": { "io.modelcontextprotocol/protocolVersion": "2026-07-28" } } });

    let unsigned = Client::new(&srv.socket, None).mcp("2026-07-28", &list).await.unwrap();
    assert_eq!(unsigned.status, 401);
    let stranger = Client::new(&srv.socket, Some(KeyPair::generate("stranger", ""))).mcp("2026-07-28", &list).await.unwrap();
    assert_eq!(stranger.status, 401);
    assert!(String::from_utf8_lossy(&stranger.body).contains("unknown key"));

    let c = Client::new(&srv.socket, Some(agent));
    let r = c
        .send(
            "POST",
            "/mcp",
            &[("mcp-protocol-version", "2026-07-28".into()), ("mcp-method", "tools/call".into())],
            serde_json::to_vec(&list).unwrap(),
        )
        .await
        .unwrap();
    assert_eq!((r.status, r.json().unwrap()["error"]["code"].as_i64()), (400, Some(-32020)), "the Mcp-Method header must match the body");
    let r = c.send("POST", "/mcp", &[("mcp-protocol-version", "1999-01-01".into())], serde_json::to_vec(&list).unwrap()).await.unwrap();
    assert_eq!((r.status, r.json().unwrap()["error"]["code"].as_i64()), (400, Some(-32022)));
    let r = c
        .send(
            "POST",
            "/mcp",
            &[("origin", "http://evil.example".into()), ("mcp-protocol-version", "2026-07-28".into()), ("mcp-method", "tools/list".into())],
            serde_json::to_vec(&list).unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(r.status, 403, "a page from another origin");
    let r = c.send("GET", "/mcp", &[], vec![]).await.unwrap();
    assert_eq!(r.status, 405);

    let wrong = Client::new(&srv.socket, Some(bound)).mcp("2026-07-28", &list).await.unwrap();
    assert_eq!(wrong.status, 401);
    assert!(String::from_utf8_lossy(&wrong.body).contains(&format!("bound to uid {other_uid}")));
    srv.stop();

    let v: serde_json::Value = serde_json::from_slice(&run(d, &["admin", "verify", "--json"]).stdout).unwrap();
    assert!(v["findings"].as_array().unwrap().is_empty(), "{v}");
    assert_eq!(v["uncovered"], 0, "the stop wrote a checkpoint");
    let pool = sqlx::SqlitePool::connect(&format!("sqlite://{}", d.join("data/spectra.db").display())).await.unwrap();
    let logged: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM events WHERE kind = 'guard.impersonation'").fetch_one(&pool).await.unwrap();
    assert_eq!(logged, 1, "the wrong-uid attempt is in the ledger");
}

#[tokio::test]
async fn owner_commands_go_through_the_running_daemon_and_learn_uid_binds() {
    let dir = setup();
    let d = dir.path();
    let srv = Serving::start(d);
    // While serve holds the ledger, the CLI's writes go through it.
    let learner = add_agent(d, "learner", &["--learn-uid"]);
    std::fs::create_dir_all(d.join("hub")).unwrap();
    let o = run(d, &["project", "add", d.join("hub").to_str().unwrap()]);
    assert!(o.status.success(), "{}", text(&o));
    let o = run(d, &["agent", "list", "--json"]);
    assert!(text(&o).contains("learner"), "{}", text(&o));

    let list = json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} });
    assert_eq!(Client::new(&srv.socket, Some(learner)).mcp("2025-11-25", &list).await.unwrap().status, 200);
    srv.stop();
    let pool = sqlx::SqlitePool::connect(&format!("sqlite://{}", d.join("data/spectra.db").display())).await.unwrap();
    let uid: Option<i64> = sqlx::query_scalar("SELECT uid FROM agents WHERE name = 'learner'").fetch_one(&pool).await.unwrap();
    assert_eq!(uid, Some(unsafe { libc::getuid() } as i64), "bound to the uid of its first signed connection");
    let v: serde_json::Value = serde_json::from_slice(&run(d, &["admin", "verify", "--json"]).stdout).unwrap();
    assert!(v["findings"].as_array().unwrap().is_empty(), "{v}");
}