package mcpsrv_test

import (
	"context"
	"io"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/go-chi/chi/v5"
	"github.com/modelcontextprotocol/go-sdk/mcp"
	"github.com/stretchr/testify/require"

	"sourcecraft.dev/bigbes/sr-ht-spec/mcpsrv"
)

// The transport the design settled on: streamable HTTP on the same chi router
// at /mcp, so that one listener and one nginx block cover the whole service.
// This is the exact mounting call cmd/specsrht makes.
func TestHandlerMountsOnChiAtMCP(t *testing.T) {
	r, s := newFixture()

	h, err := mcpsrv.Handler(mcpsrv.Backend{Docs: r, Index: s}, "test", "https://spec.srht.bigb.es")
	require.NoError(t, err)

	router := chi.NewRouter()
	router.Handle("/mcp", h)

	srv := httptest.NewServer(router)
	t.Cleanup(srv.Close)

	client := mcp.NewClient(&mcp.Implementation{Name: "test-client", Version: "test"}, nil)
	session, err := client.Connect(context.Background(),
		&mcp.StreamableClientTransport{Endpoint: srv.URL + "/mcp"}, nil)
	require.NoError(t, err)
	t.Cleanup(func() { _ = session.Close() })

	require.Equal(t, mcpsrv.ServerName, session.InitializeResult().ServerInfo.Name)

	res, err := session.CallTool(context.Background(), &mcp.CallToolParams{
		Name:      "spec_read",
		Arguments: map[string]any{"space": "~bigbes/rfcs", "document": "SPEC-0007"},
	})
	require.NoError(t, err)
	var out readResult
	decode(t, res, &out)
	require.Contains(t, out.Markdown, "the approved body")
	require.Equal(t, approvedRev, out.Rev)
}

// The deployment shape, pinned by a test because it is invisible otherwise:
// the daemon listens on loopback and nginx forwards with the public Host
// (`proxy_set_header Host $host`). The SDK's DNS-rebinding guard rejects
// exactly that combination with a 403, so Handler disables it. Without this
// test the whole MCP endpoint would 403 in production and pass every local
// check, since a local client sends a loopback Host.
func TestHandlerAcceptsProxiedHostHeader(t *testing.T) {
	r, s := newFixture()

	h, err := mcpsrv.Handler(mcpsrv.Backend{Docs: r, Index: s}, "test", "https://spec.srht.bigb.es")
	require.NoError(t, err)

	router := chi.NewRouter()
	router.Handle("/mcp", h)
	srv := httptest.NewServer(router)
	t.Cleanup(srv.Close)

	body := `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{` +
		`"protocolVersion":"2025-06-18","capabilities":{},` +
		`"clientInfo":{"name":"test-client","version":"test"}}}`

	req, err := http.NewRequest(http.MethodPost, srv.URL+"/mcp", io.Reader(strings.NewReader(body)))
	require.NoError(t, err)
	req.Host = "spec.srht.bigb.es"
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json, text/event-stream")

	resp, err := srv.Client().Do(req)
	require.NoError(t, err)
	t.Cleanup(func() { _ = resp.Body.Close() })

	require.Equal(t, http.StatusOK, resp.StatusCode,
		"a loopback listener behind a proxy that sets the public Host must not be refused")
}