"""Tests for gitea_resolve_task_capability tool.

Covers Issue #141 requirements.
"""
import os
import sys
import json
import tempfile
import unittest
from unittest.mock import patch, MagicMock

sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))

import gitea_config
import gitea_auth
import mcp_server

CONFIG_RESOLVER = {
    "version": 2,
    "contexts": {
        "ctx": {
            "enabled": True,
            "gitea": {
                "enabled": True,
                "base_url": "https://gitea.example.com"
            }
        }
    },
    "profiles": {
        "author-profile": {
            "enabled": True,
            "context": "ctx",
            "role": "author",
            "username": "author-user",
            "auth": {"type": "env", "name": "GITEA_TOKEN_AUTHOR"},
            "allowed_operations": ["gitea.read", "gitea.issue.create", "gitea.pr.create", "gitea.branch.push", "gitea.issue.comment"],
            "forbidden_operations": ["gitea.pr.approve", "gitea.pr.merge"],
            "execution_profile": "author-profile"
        },
        "reviewer-profile": {
            "enabled": True,
            "context": "ctx",
            "role": "reviewer",
            "username": "reviewer-user",
            "auth": {"type": "env", "name": "GITEA_TOKEN_REVIEWER"},
            "allowed_operations": ["gitea.read", "gitea.pr.review", "gitea.pr.approve", "gitea.pr.merge", "gitea.issue.comment"],
            "forbidden_operations": ["gitea.pr.create", "gitea.branch.push"],
            "execution_profile": "reviewer-profile"
        }
    },
    "rules": {
        "allow_runtime_switching": False
    }
}

class TestResolveTaskCapability(unittest.TestCase):
    def setUp(self):
        self._remotes_patch = patch.dict(mcp_server.REMOTES, {
            "dadeschools": {"host": "gitea.example.com", "org": "Example-Org", "repo": "Example-Repo"},
            "prgs": {"host": "gitea.example.com", "org": "Example-Org", "repo": "Example-Repo"}
        })
        self._remotes_patch.start()
        mcp_server._IDENTITY_CACHE.clear()
        gitea_config._active_profile_override = None
        self._dir = tempfile.TemporaryDirectory()
        self.config_path = os.path.join(self._dir.name, "profiles.json")
        self._write_config(CONFIG_RESOLVER)

    def tearDown(self):
        self._remotes_patch.stop()
        mcp_server._IDENTITY_CACHE.clear()
        gitea_config._active_profile_override = None
        self._dir.cleanup()

    def _write_config(self, obj):
        with open(self.config_path, "w", encoding="utf-8") as fh:
            fh.write(json.dumps(obj))

    def _env(self, profile="author-profile"):
        return {
            "GITEA_MCP_CONFIG": self.config_path,
            "GITEA_MCP_PROFILE": profile,
            "GITEA_TOKEN_AUTHOR": "author-pass",
            "GITEA_TOKEN_REVIEWER": "reviewer-pass",
        }

    @patch("mcp_server.api_request", return_value={"login": "author-user"})
    @patch("mcp_server.get_auth_header", return_value="token author-pass")
    def test_resolve_author_capable_task(self, _auth, _api):
        with patch.dict(os.environ, self._env("author-profile")):
            res = mcp_server.gitea_resolve_task_capability(task="create_issue", remote="prgs")
            self.assertEqual(res["requested_task"], "create_issue")
            self.assertEqual(res["required_operation_permission"], "gitea.issue.create")
            self.assertEqual(res["required_role_kind"], "author")
            self.assertEqual(res["active_profile"], "author-profile")
            self.assertTrue(res["allowed_in_current_session"])
            self.assertIn("author-profile", res["matching_configured_profile"])
            self.assertFalse(res["different_mcp_namespace_required"])
            self.assertIn("ready for operations", res["exact_safe_next_action"])

    @patch("mcp_server.api_request", return_value={"login": "author-user"})
    @patch("mcp_server.get_auth_header", return_value="token author-pass")
    def test_resolve_reviewer_capable_task_blocked(self, _auth, _api):
        with patch.dict(os.environ, self._env("author-profile")):
            res = mcp_server.gitea_resolve_task_capability(task="review_pr", remote="prgs")
            self.assertEqual(res["requested_task"], "review_pr")
            self.assertEqual(res["required_operation_permission"], "gitea.pr.review")
            self.assertEqual(res["required_role_kind"], "reviewer")
            self.assertEqual(res["active_profile"], "author-profile")
            self.assertFalse(res["allowed_in_current_session"])
            self.assertIn("reviewer-profile", res["matching_configured_profile"])
            self.assertTrue(res["different_mcp_namespace_required"])
            self.assertIn("gitea-reviewer", res["exact_safe_next_action"])

    @patch("mcp_server.api_request", return_value={"login": "reviewer-user"})
    @patch("mcp_server.get_auth_header", return_value="token reviewer-pass")
    def test_resolve_reviewer_capable_task_allowed(self, _auth, _api):
        with patch.dict(os.environ, self._env("reviewer-profile")):
            res = mcp_server.gitea_resolve_task_capability(task="review_pr", remote="prgs")
            self.assertTrue(res["allowed_in_current_session"])
            self.assertFalse(res["different_mcp_namespace_required"])

    @patch("mcp_server.api_request", return_value={"login": "author-user"})
    @patch("mcp_server.get_auth_header", return_value="token author-pass")
    def test_resolve_issue_comment_task(self, _auth, _api):
        with patch.dict(os.environ, self._env("author-profile")):
            res = mcp_server.gitea_resolve_task_capability(task="comment_issue", remote="prgs")
            self.assertTrue(res["allowed_in_current_session"])
            self.assertIn("author-profile", res["matching_configured_profile"])
            self.assertIn("reviewer-profile", res["matching_configured_profile"])

    def test_resolve_unknown_task_fails_closed(self):
        with patch.dict(os.environ, self._env("author-profile")):
            with self.assertRaises(ValueError):
                mcp_server.gitea_resolve_task_capability(task="invalid_task_xyz", remote="prgs")

if __name__ == "__main__":
    unittest.main()