"""
Тесты фасада iss-agent-kit: AgentGuard поверх mcp-sentinel + iss-ledger-117.
"""

import os
import shutil
import tempfile
import unittest

from iss_agent_kit import ActionBlocked, AgentGuard


class TestAgentGuard(unittest.TestCase):
    def setUp(self):
        self.test_dir = tempfile.mkdtemp()
        self.ledger_path = os.path.join(self.test_dir, "kit_audit.jsonl")
        self.guard = AgentGuard(ledger_path=self.ledger_path, agent_id="test-agent")

    def tearDown(self):
        shutil.rmtree(self.test_dir, ignore_errors=True)

    def test_run_blocks_call_and_does_not_invoke_fn(self):
        called = {"flag": False}

        def sql_query(query: str):
            called["flag"] = True
            return "should not run"

        with self.assertRaises(ActionBlocked) as ctx:
            self.guard.run(sql_query, "sql_query", {"query": "DROP TABLE users;"})

        self.assertEqual(ctx.exception.stage, "call")
        self.assertFalse(called["flag"], "fn не должна вызываться при BLOCK на стадии call")

    def test_run_permits_call_and_returns_result(self):
        called = {"flag": False}

        def sql_query(query: str):
            called["flag"] = True
            return "id=1"

        result = self.guard.run(sql_query, "sql_query", {"query": "SELECT id FROM users WHERE id = 1;"})

        self.assertTrue(called["flag"], "fn должна быть вызвана при PERMIT")
        self.assertEqual(result, "id=1")

    def test_run_blocks_leaking_result(self):
        def read_file(path: str):
            return "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEA...\n-----END RSA PRIVATE KEY-----"

        with self.assertRaises(ActionBlocked) as ctx:
            self.guard.run(read_file, "read_file", {"path": "safe.txt"})

        self.assertEqual(ctx.exception.stage, "result")

    def test_tool_decorator_routes_through_run(self):
        @self.guard.tool("sql_query")
        def sql_query(query: str):
            return f"executed: {query}"

        result = sql_query(query="SELECT id FROM users WHERE id = 1;")
        self.assertEqual(result, "executed: SELECT id FROM users WHERE id = 1;")

        with self.assertRaises(ActionBlocked):
            sql_query(query="DROP TABLE users;")

    def test_verify_ledger_reports_valid_chain(self):
        self.guard.check("sql_query", {"query": "SELECT 1"})
        self.guard.check("sql_query", {"query": "DROP TABLE users;"})

        is_valid, count, _msg = self.guard.verify_ledger()
        self.assertTrue(is_valid)
        self.assertGreaterEqual(count, 2)

    def test_verify_ledger_disabled(self):
        guard = AgentGuard(ledger_path=None)
        is_valid, count, msg = guard.verify_ledger()
        self.assertTrue(is_valid)
        self.assertEqual(count, 0)
        self.assertEqual(msg, "ledger disabled")


if __name__ == "__main__":
    unittest.main()