from __future__ import annotations

from fastapi import FastAPI
from fastapi.testclient import TestClient

from src.api.v1.iwooos import router
from src.services.iwooos_high_value_config_control_coverage import (
    load_latest_iwooos_high_value_config_control_coverage,
)


def _client() -> TestClient:
    app = FastAPI()
    app.include_router(router)
    return TestClient(app)


def test_iwooos_high_value_config_control_coverage_prioritizes_nginx_and_configs() -> None:
    payload = load_latest_iwooos_high_value_config_control_coverage()

    assert payload["schema_version"] == "iwooos_high_value_config_control_coverage_v1"
    assert payload["status"] == "coverage_matrix_ready_no_runtime_action"
    assert payload["summary"]["category_count"] == 14
    assert payload["summary"]["c0_category_count"] == 8
    assert payload["summary"]["average_coverage_percent"] == 73
    assert payload["summary"]["owner_response_received_count"] == 0
    assert payload["summary"]["owner_response_accepted_count"] == 0
    assert payload["summary"]["runtime_gate_count"] == 0
    assert payload["summary"]["action_button_count"] == 0

    priority_ids = [lane["category_id"] for lane in payload["priority_lanes"]]
    assert priority_ids[:6] == [
        "nginx_public_gateway",
        "dns_tls_certbot",
        "k8s_production_gitops",
        "secret_metadata",
        "gitea_workflow_runner_source_control",
        "public_admin_api_runtime_config",
    ]
    assert payload["priority_lanes"][0]["label"] == "Nginx / 公開入口 / 反向代理"
    assert payload["priority_lanes"][0]["coverage_percent"] == 92
    assert payload["priority_lanes"][0]["runtime_gate_open"] is False


def test_iwooos_high_value_config_control_coverage_keeps_boundaries_closed() -> None:
    payload = load_latest_iwooos_high_value_config_control_coverage()

    boundaries = payload["execution_boundaries"]
    assert boundaries["not_authorization"] is True
    for key, value in boundaries.items():
        if key == "not_authorization":
            continue
        assert value is False

    assert all(lane["owner_response_received"] is False for lane in payload["priority_lanes"])
    assert all(lane["owner_response_accepted"] is False for lane in payload["priority_lanes"])
    assert all(lane["runtime_gate_open"] is False for lane in payload["priority_lanes"])
    assert all(lane["action_buttons_allowed"] is False for lane in payload["priority_lanes"])
    assert "high_value_config_control_coverage_runtime_gate_count=0" in payload["boundary_markers"]
    assert "high_value_config_control_coverage_action_button_count=0" in payload["boundary_markers"]


def test_iwooos_high_value_config_control_coverage_api_is_public_safe() -> None:
    response = _client().get("/api/v1/iwooos/high-value-config-control-coverage")

    assert response.status_code == 200
    data = response.json()
    assert data["schema_version"] == "iwooos_high_value_config_control_coverage_v1"
    assert data["summary"]["runtime_gate_count"] == 0
    assert data["priority_lanes"][0]["category_id"] == "nginx_public_gateway"
    assert data["priority_lanes"][0]["label"] == "Nginx / 公開入口 / 反向代理"
    assert "192.168.0." not in response.text
    assert "工作視窗" not in response.text
    assert "批准！繼續" not in response.text
    assert "source_thread_id" not in response.text
    assert "owenhytsai/" not in response.text
    assert "raw Wazuh payload" not in response.text
