from __future__ import annotations

from fastapi import FastAPI
from fastapi.testclient import TestClient

from src.api.v1.iwooos import router
from src.services.iwooos_wazuh_managed_host_coverage import (
    load_latest_iwooos_wazuh_managed_host_coverage,
)


def _client() -> TestClient:
    app = FastAPI()
    app.include_router(router)
    return TestClient(app)


def test_iwooos_wazuh_managed_host_coverage_accepts_registry_readback_without_runtime() -> None:
    payload = load_latest_iwooos_wazuh_managed_host_coverage()

    assert payload["schema_version"] == "iwooos_wazuh_managed_host_coverage_readback_v1"
    assert payload["status"] == "manager_registry_readback_accepted_runtime_gate_closed"
    assert payload["mode"] == "committed_snapshot_readback_alias_only_no_wazuh_live_query"
    assert payload["summary"]["expected_host_scope_count"] == 6
    assert payload["summary"]["host_scope_matrix_count"] == 6
    assert payload["summary"]["direct_agent_active_observed_count"] == 2
    assert payload["summary"]["direct_agent_missing_or_no_transport_count"] == 1
    assert payload["summary"]["ssh_readback_blocked_count"] == 3
    assert payload["summary"]["manager_registry_accepted_count"] == 6
    assert payload["summary"]["manager_registry_gap_count"] == 0
    assert payload["summary"]["required_evidence_before_green_count"] == 6
    assert payload["summary"]["required_evidence_accepted_count"] == 6
    assert payload["summary"]["runtime_gate_count"] == 0
    assert payload["summary"]["active_response_authorized_count"] == 0
    assert payload["summary"]["host_write_authorized_count"] == 0
    assert payload["summary"]["agent_reenroll_authorized_count"] == 0
    assert payload["summary"]["agent_restart_authorized_count"] == 0

    boundaries = payload["boundaries"]
    assert boundaries["not_authorization"] is True
    for key, value in boundaries.items():
        if key == "not_authorization":
            continue
        assert value is False


def test_iwooos_wazuh_managed_host_coverage_alias_matrix_is_complete() -> None:
    payload = load_latest_iwooos_wazuh_managed_host_coverage()

    matrix = payload["host_scope_matrix"]
    assert [item["node_id"] for item in matrix] == [
        "managed_core_node_a",
        "managed_core_node_b",
        "managed_dev_node_a",
        "managed_dev_node_b",
        "managed_control_node_a",
        "managed_control_node_b",
    ]
    assert all(item["node_id"].startswith("managed_") for item in matrix)
    assert all(item["manager_registry_accepted"] is True for item in matrix)
    assert matrix[0]["readback_status"] == "agent_active_transport_observed"
    assert matrix[0]["next_gate"] == "runtime_gate_owner_review"
    assert matrix[2]["readback_status"] == "no_agent_transport_observed"
    assert matrix[3]["readback_status"] == "ssh_readback_blocked"
    assert matrix[3]["next_gate"] == "runtime_gate_owner_review"


def test_iwooos_wazuh_managed_host_coverage_api_is_public_safe() -> None:
    response = _client().get("/api/v1/iwooos/wazuh-managed-host-coverage")

    assert response.status_code == 200
    data = response.json()
    assert data["schema_version"] == "iwooos_wazuh_managed_host_coverage_readback_v1"
    assert data["summary"]["expected_host_scope_count"] == 6
    assert data["summary"]["manager_registry_accepted_count"] == 6
    assert data["summary"]["manager_registry_gap_count"] == 0
    assert data["summary"]["required_evidence_accepted_count"] == 6
    assert data["summary"]["runtime_gate_count"] == 0
    assert len(data["host_scope_matrix"]) == 6
    assert any(marker == "wazuh_managed_host_coverage_host_scope_matrix_count=6" for marker in data["boundary_markers"])
    assert any(marker == "wazuh_managed_host_coverage_manager_registry_accepted_count=6" for marker in data["boundary_markers"])
    assert any(marker == "wazuh_managed_host_coverage_manager_registry_gap_count=0" for marker in data["boundary_markers"])
    assert any(marker == "wazuh_managed_host_coverage_required_evidence_accepted_count=6" for marker in data["boundary_markers"])
    assert any(rule.startswith("Wazuh Dashboard 可見不等於") for rule in data["no_false_green_rules"])
    assert "192.168.0." not in response.text
    assert "工作視窗" not in response.text
    assert "批准！繼續" not in response.text
    assert "source_thread_id" not in response.text
    assert "owenhytsai/" not in response.text
    assert "WAZUH_API_PASSWORD" not in response.text