import test from 'node:test';
import assert from 'node:assert/strict';
import { authorizeTool, validateArguments } from '../src/policy.js';
import { runTool } from '../src/tools.js';

test('schema validation rejects unknown and mistyped arguments', async () => {
  const result = await runTool('ruview_onboard', { path: 7, injected: true });
  assert.equal(result.ok, false);
  assert.equal(result.reason, 'invalid_arguments');
  assert.ok(result.errors.some((error) => error.includes('injected')));
});

test('MCP workspace writes require confirmation and an explicit grant', () => {
  assert.equal(authorizeTool('ruview_calibrate', {}, { source: 'mcp', grants: [] }).reason, 'not_confirmed');
  assert.equal(authorizeTool('ruview_calibrate', { confirm: true }, { source: 'mcp', grants: [] }).reason, 'authority_denied');
  assert.equal(authorizeTool('ruview_calibrate', { confirm: true }, { source: 'mcp', grants: ['workspace-write'] }).ok, true);
});

test('read-only tools remain available with no mutation grants', () => {
  assert.equal(authorizeTool('ruview_claim_check', { text: 'safe' }, { source: 'mcp', grants: [] }).ok, true);
  assert.equal(authorizeTool('ruview_guidance', {}, { source: 'mcp', grants: [] }).ok, true);
  assert.deepEqual(validateArguments({ type: 'object', properties: {} }, {}), []);
});

test('credentialed external reads require an explicit MCP grant', () => {
  const denied = authorizeTool('ruview_spaces_list', {}, { source: 'mcp', grants: [] });
  assert.equal(denied.reason, 'authority_denied');
  assert.equal(denied.requiredGrant, 'credential-use');
  assert.equal(authorizeTool('ruview_spaces_list', {}, { source: 'mcp', grants: ['credential-use'] }).ok, true);
  assert.equal(authorizeTool('ruview_spaces_list', {}, { source: 'cli', grants: [] }).ok, true);
});

test('Spaces schema never accepts raw credentials', async () => {
  for (const credential of [
    { token: 'secret' },
    { access_token: 'secret' },
    { api_key: 'cog_secret' },
    { authorization: 'Bearer secret' },
    { base_url: 'https://attacker.example' },
  ]) {
    const result = await runTool('ruview_spaces_list', credential);
    assert.equal(result.ok, false);
    assert.equal(result.reason, 'invalid_arguments');
  }
});