package mcphttp_test

import (
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"sourcecraft.dev/bigbes/sr-ht-ecore/mcphttp"
)

// TestStatelessSessions pins the option that decides where a tool handler's
// identity comes from. With Stateless off, the SDK hands every call the context
// of the request that initialised the session, so the session id becomes a
// credential nobody minted, scoped or can revoke. That is a security change that
// would show up as no compile error and no failing tool test.
func TestStatelessSessions(t *testing.T) {
	opts := mcphttp.StreamableOptions()
	require.NotNil(t, opts)

	assert.True(t, opts.Stateless, "a stateful session authenticates by session id")
}

// TestTheSDKGuardIsDisabled pins the other half of the deployment decision. It is
// only defensible together with HostGuard, so read it next to
// TestUnexpectedHostIsRefused: this option removes a check and that test is the
// replacement.
func TestTheSDKGuardIsDisabled(t *testing.T) {
	assert.True(t, mcphttp.StreamableOptions().DisableLocalhostProtection,
		"the SDK guard refuses every request nginx forwards, and only in production")
}

// TestEachCallGetsItsOwnValue keeps one endpoint from reconfiguring another: the
// SDK takes a pointer and would happily hold a shared one.
func TestEachCallGetsItsOwnValue(t *testing.T) {
	a, b := mcphttp.StreamableOptions(), mcphttp.StreamableOptions()

	require.NotSame(t, a, b)

	a.Stateless = false
	assert.True(t, b.Stateless, "one caller's mutation must not reach another's options")
}