"""Tier 7 — security tests for knowtation MCP."""

from __future__ import annotations

import pathlib

import pytest

from muse.core.attestation import get_attestation_provider, unregister_attestation_provider
from muse.mcp.errors import MCPApplicationError
from muse.mcp.server import MuseMCPServer
from muse.mcp.namespaces.knowtation import KnowtationNamespace
from muse.plugins.knowtation.mcp_helpers import validate_note_path


@pytest.fixture
def smoke_root() -> pathlib.Path:
    return pathlib.Path("/Users/aaronrenecarvajal/MUSE_HUB/knowtation-vault-smoke")


def test_path_traversal_rejected() -> None:
    with pytest.raises(Exception) as exc:
        validate_note_path("../../secret.md")
    assert exc.value.reason == "PATH_INVALID"


def test_activation_gate_blocks_tools(tmp_path: pathlib.Path) -> None:
    (tmp_path / ".muse").mkdir()
    (tmp_path / ".muse" / "repo.json").write_text('{"domain":"code","repo_id":"x"}', encoding="utf-8")
    server = MuseMCPServer(tmp_path)
    resp = server.handle_request(
        {
            "jsonrpc": "2.0",
            "id": 1,
            "method": "tools/call",
            "params": {"name": "knowtation/search", "arguments": {"query": "x"}},
        }
    )
    assert resp is not None
    assert "error" in resp


def test_provider_unregistered_attest(smoke_root: pathlib.Path) -> None:
    ns = KnowtationNamespace(smoke_root)
    unregister_attestation_provider("knowtation")
    try:
        with pytest.raises(MCPApplicationError) as exc:
            ns.call_tool("knowtation/attest", {"commit_id": "0" * 64})
        assert exc.value.reason == "PROVIDER_UNREGISTERED"
    finally:
        from muse.mcp.bootstrap import bootstrap_knowtation_mcp

        bootstrap_knowtation_mcp(smoke_root)
        assert get_attestation_provider("knowtation") is not None


def test_no_secrets_in_search_error(smoke_root: pathlib.Path) -> None:
    ns = KnowtationNamespace(smoke_root)
    out = ns.call_tool("knowtation/search", {"query": "test", "mode": "lexical"})
    blob = str(out)
    for secret in ("MUSE_AIR_HMAC_KEY", "KNOWTATION_HUB_PORT", "BEGIN PRIVATE KEY"):
        assert secret not in blob


def test_resource_path_escape_rejected(smoke_root: pathlib.Path) -> None:
    ns = KnowtationNamespace(smoke_root)
    with pytest.raises(MCPApplicationError):
        ns.read_resource("knowtation://vault/../../etc/passwd.md")