alien-bindings 3.3.27

use super::*;
use crate::remote::access::RemoteBindingSelector;

#[tokio::test]
async fn preissued_manager_access_loads_a_binding_without_platform_discovery() {
    let expires_at = Utc::now() + ChronoDuration::minutes(5);
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        json!({
            "service": "s3",
            "binding": { "bucketName": "customer-bucket" },
            "clientConfig": {
                "accountId": "123456789012",
                "region": "us-east-1",
                "credentials": {
                    "type": "sessionCredentials",
                    "accessKeyId": "AKIAEXAMPLE",
                    "secretAccessKey": "secret",
                    "sessionToken": "session",
                    "expiresAt": expires_at.to_rfc3339(),
                },
            },
            "expiresAt": expires_at.to_rfc3339(),
        }),
    )));
    let requests = Arc::new(StdMutex::new(Vec::new()));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response,
        requests: requests.clone(),
    })
    .await;

    let bindings = RemoteBindings::from_manager_access(
        DEPLOYMENT_ID,
        &manager_url,
        GENERATED_MANAGER_TOKEN,
        expires_at,
    )
    .expect("construct bindings from assigned Manager access");
    bindings
        .storage("files")
        .await
        .expect("resolve the binding directly through Manager");

    assert_eq!(
        requests
            .lock()
            .expect("generated contract requests lock")
            .as_slice(),
        &[RecordedRequest {
            method: "POST".to_string(),
            path: "/v1/bindings/resolve".to_string(),
            authorization: Some(format!("Bearer {GENERATED_MANAGER_TOKEN}")),
            body: Some(json!({
                "deploymentId": DEPLOYMENT_ID,
                "resourceId": "files",
            })),
        }]
    );
}

#[tokio::test]
async fn generated_manager_adapter_decodes_cloud_lease_and_structured_error() {
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        json!({
            "service": "s3",
            "binding": { "bucketName": "customer-bucket" },
            "clientConfig": {
                "accountId": "123456789012",
                "region": "us-east-1",
                "credentials": {
                    "type": "sessionCredentials",
                    "accessKeyId": "AKIAEXAMPLE",
                    "secretAccessKey": "secret",
                    "sessionToken": "session",
                    "expiresAt": at(3600).to_rfc3339(),
                },
            },
            "expiresAt": at(3600).to_rfc3339(),
        }),
    )));
    let requests = Arc::new(StdMutex::new(Vec::new()));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response: response.clone(),
        requests: requests.clone(),
    })
    .await;
    let adapter = GeneratedManagerBindingResolver;
    let manager_url = reqwest::Url::parse(&manager_url).expect("valid manager URL");
    let manager = DiscoveredManager {
        deployment_id: DEPLOYMENT_ID.to_string(),
        url: manager_url,
        http: authenticated_http_client(GENERATED_MANAGER_TOKEN, "generated manager fixture")
            .expect("build generated contract client"),
        refresh_at: at(300),
        generation: 0,
    };

    let lease = adapter
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("files"),
        )
        .await
        .expect("generated client should decode an S3 lease");
    let ResolvedRemoteBinding::S3 {
        binding,
        client_config,
        expires_at,
    } = lease
    else {
        panic!("generated client returned the wrong lease variant for S3");
    };
    assert_eq!(
        binding.bucket_name,
        alien_core::BindingValue::Value("customer-bucket".to_string())
    );
    assert_eq!(client_config.account_id, "123456789012");
    assert_eq!(client_config.region, "us-east-1");
    assert!(client_config.service_overrides.is_none());
    let alien_core::AwsCredentials::SessionCredentials {
        access_key_id,
        secret_access_key,
        session_token,
        expires_at: credential_expires_at,
    } = client_config.credentials
    else {
        panic!("generated client returned a non-session AWS credential");
    };
    assert_eq!(access_key_id, "AKIAEXAMPLE");
    assert_eq!(secret_access_key, "secret");
    assert_eq!(session_token, "session");
    assert_eq!(credential_expires_at, at(3600).to_rfc3339());
    assert_eq!(expires_at, at(3600));
    assert_eq!(
        requests
            .lock()
            .expect("generated contract requests lock")
            .as_slice(),
        &[RecordedRequest {
            method: "POST".to_string(),
            path: "/v1/bindings/resolve".to_string(),
            authorization: Some(format!("Bearer {GENERATED_MANAGER_TOKEN}")),
            body: Some(json!({
                "deploymentId": DEPLOYMENT_ID,
                "resourceId": "files",
            })),
        }]
    );

    *response.write().expect("generated contract response lock") = (
        StatusCode::OK,
        json!({
            "service": "blob",
            "binding": {
                "accountName": "customeraccount",
                "containerName": "customer-container",
            },
            "clientConfig": {
                "subscriptionId": "subscription-id",
                "tenantId": "tenant-id",
                "region": "eastus",
                "credentials": {
                    "type": "accessToken",
                    "token": "azure-storage-token",
                },
            },
            "expiresAt": at(3600).to_rfc3339(),
        }),
    );
    let lease = adapter
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("files"),
        )
        .await
        .expect("generated client should decode a Blob lease");
    let ResolvedRemoteBinding::Blob {
        binding,
        client_config,
        expires_at,
    } = lease
    else {
        panic!("generated client returned the wrong lease variant for Blob");
    };
    assert_eq!(
        binding.account_name,
        alien_core::BindingValue::Value("customeraccount".to_string())
    );
    assert_eq!(
        binding.container_name,
        alien_core::BindingValue::Value("customer-container".to_string())
    );
    assert_eq!(client_config.subscription_id, "subscription-id");
    assert_eq!(client_config.tenant_id, "tenant-id");
    assert_eq!(client_config.region.as_deref(), Some("eastus"));
    assert!(client_config.service_overrides.is_none());
    let alien_core::AzureCredentials::AccessToken { token } = client_config.credentials else {
        panic!("generated client returned the wrong Azure credential type");
    };
    assert_eq!(token, "azure-storage-token");
    assert_eq!(expires_at, at(3600));

    *response.write().expect("generated contract response lock") = (
        StatusCode::OK,
        json!({
            "service": "gcs",
            "binding": { "bucketName": "customer-bucket" },
            "clientConfig": {
                "projectId": "customer-project",
                "projectNumber": "123456789",
                "region": "us-central1",
                "credentials": {
                    "type": "accessToken",
                    "token": "gcp-access-token",
                },
            },
            "expiresAt": at(3600).to_rfc3339(),
        }),
    );
    let lease = adapter
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("files"),
        )
        .await
        .expect("generated client should decode a GCS lease");
    let ResolvedRemoteBinding::Gcs {
        binding,
        client_config,
        expires_at,
    } = lease
    else {
        panic!("generated client returned the wrong lease variant for GCS");
    };
    assert_eq!(
        binding.bucket_name,
        alien_core::BindingValue::Value("customer-bucket".to_string())
    );
    assert_eq!(client_config.project_id, "customer-project");
    assert_eq!(client_config.project_number.as_deref(), Some("123456789"));
    assert_eq!(client_config.region, "us-central1");
    assert!(client_config.service_overrides.is_none());
    let alien_core::GcpCredentials::AccessToken { token } = client_config.credentials else {
        panic!("generated client returned the wrong GCP credential type");
    };
    assert_eq!(token, "gcp-access-token");
    assert_eq!(expires_at, at(3600));

    *response.write().expect("generated contract response lock") = (
        StatusCode::OK,
        json!({
            "service": "s3",
            "binding": { "bucketName": "customer-bucket" },
            "clientConfig": {
                "accountId": "123456789012",
                "region": "us-east-1",
                "credentials": {
                    "type": "sessionCredentials",
                    "accessKeyId": "SENTINEL_ACCESS_KEY",
                    "secretAccessKey": "SENTINEL_SECRET_KEY",
                    "sessionToken": "SENTINEL_SESSION_TOKEN",
                    "expiresAt": at(3600).to_rfc3339(),
                },
            },
            "expiresAt": "not-a-timestamp",
        }),
    );
    let error = match adapter
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("files"),
        )
        .await
    {
        Ok(_) => panic!("an invalid lease expiry must fail typed conversion"),
        Err(error) => error,
    };
    let error_debug = format!("{error:?}");
    for secret in [
        "SENTINEL_ACCESS_KEY",
        "SENTINEL_SECRET_KEY",
        "SENTINEL_SESSION_TOKEN",
    ] {
        assert!(
            !error_debug.contains(secret),
            "typed conversion errors must not retain response credentials"
        );
    }

    *response.write().expect("generated contract response lock") = (
        StatusCode::FORBIDDEN,
        json!({
            "code": "FORBIDDEN",
            "message": "Remote access was revoked",
            "retryable": false,
            "internal": false,
            "httpStatusCode": 403,
        }),
    );
    let error = match adapter
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("files"),
        )
        .await
    {
        Ok(_) => panic!("generated client should preserve a structured manager error"),
        Err(error) => error,
    };
    assert_eq!(error.code, "FORBIDDEN");
    assert_eq!(error.message, "Remote access was revoked");
    assert!(!error.retryable);
    assert_eq!(error.http_status_code, Some(403));
}

#[tokio::test]
async fn remote_ai_returns_a_typed_redacted_bedrock_lease() {
    let expires_at = Utc::now() + ChronoDuration::minutes(5);
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        json!({
            "service": "bedrock",
            "resourceId": "models",
            "binding": { "region": "us-east-1" },
            "clientConfig": {
                "accountId": "123456789012",
                "region": "us-east-1",
                "credentials": {
                    "type": "sessionCredentials",
                    "accessKeyId": "SENTINEL_ACCESS_KEY",
                    "secretAccessKey": "SENTINEL_SECRET_KEY",
                    "sessionToken": "SENTINEL_SESSION_TOKEN",
                    "expiresAt": expires_at.to_rfc3339(),
                },
            },
            "expiresAt": expires_at.to_rfc3339(),
        }),
    )));
    let requests = Arc::new(StdMutex::new(Vec::new()));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response,
        requests: requests.clone(),
    })
    .await;
    let bindings = RemoteBindings::from_manager_access(
        DEPLOYMENT_ID,
        &manager_url,
        GENERATED_MANAGER_TOKEN,
        expires_at,
    )
    .expect("construct bindings from assigned Manager access");

    let lease = bindings.ai().await.expect("resolve Bedrock AI lease");
    assert_eq!(lease.resource_id, "models");
    assert_eq!(lease.binding, alien_core::AiBinding::bedrock("us-east-1"));
    assert_eq!(lease.client_config.platform(), alien_core::Platform::Aws);
    assert_eq!(
        requests
            .lock()
            .expect("generated contract requests lock")
            .as_slice(),
        &[RecordedRequest {
            method: "POST".to_string(),
            path: "/v1/bindings/resolve".to_string(),
            authorization: Some(format!("Bearer {GENERATED_MANAGER_TOKEN}")),
            body: Some(json!({
                "deploymentId": DEPLOYMENT_ID,
                "kind": "ai",
            })),
        }]
    );
    let debug = format!("{lease:?}");
    for secret in [
        "SENTINEL_ACCESS_KEY",
        "SENTINEL_SECRET_KEY",
        "SENTINEL_SESSION_TOKEN",
    ] {
        assert!(!debug.contains(secret));
    }
}

const SANDBOX_IMAGE_ARN: &str =
    "arn:aws:lambda:us-east-1:123456789012:microvm-image/alien-agent-image";

/// One `sandbox-aws` resolve response, with the two fields whose handling the refusal tests
/// vary left as parameters.
fn sandbox_lease_body(
    expires_at: DateTime<Utc>,
    preview_ports: serde_json::Value,
    allow_egress: bool,
) -> serde_json::Value {
    json!({
        "service": "sandbox-aws",
        "binding": {
            "imageArn": SANDBOX_IMAGE_ARN,
            "imageVersion": "7",
            "region": "us-east-1",
            "previewPorts": preview_ports,
            "idlePauseSeconds": 300,
            "maxLifetimeSeconds": 3600,
            "allowEgress": allow_egress,
        },
        "clientConfig": {
            "accountId": "123456789012",
            "region": "us-west-2",
            "credentials": {
                "type": "sessionCredentials",
                "accessKeyId": "SENTINEL_ACCESS_KEY",
                "secretAccessKey": "SENTINEL_SECRET_KEY",
                "sessionToken": "SENTINEL_SESSION_TOKEN",
                "expiresAt": expires_at.to_rfc3339(),
            },
        },
        "expiresAt": expires_at.to_rfc3339(),
    })
}

fn sandbox_resolve_request() -> RecordedRequest {
    RecordedRequest {
        method: "POST".to_string(),
        path: "/v1/bindings/resolve".to_string(),
        authorization: Some(format!("Bearer {GENERATED_MANAGER_TOKEN}")),
        body: Some(json!({
            "deploymentId": DEPLOYMENT_ID,
            "resourceId": "agent",
        })),
    }
}

#[tokio::test]
async fn remote_sandbox_decodes_every_declared_field_and_reaches_the_aws_provider() {
    let expires_at = Utc::now() + ChronoDuration::minutes(5);
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        sandbox_lease_body(expires_at, json!([8080, 3000]), true),
    )));
    let requests = Arc::new(StdMutex::new(Vec::new()));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response,
        requests: requests.clone(),
    })
    .await;

    let adapter = GeneratedManagerBindingResolver;
    let manager = DiscoveredManager {
        deployment_id: DEPLOYMENT_ID.to_string(),
        url: reqwest::Url::parse(&manager_url).expect("valid manager URL"),
        http: authenticated_http_client(GENERATED_MANAGER_TOKEN, "generated manager fixture")
            .expect("build generated contract client"),
        refresh_at: expires_at,
        generation: 0,
    };
    let lease = adapter
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("agent"),
        )
        .await
        .expect("generated client should decode a sandbox lease");
    let ResolvedRemoteBinding::SandboxAws {
        binding,
        client_config,
        expires_at: lease_expires_at,
    } = lease
    else {
        panic!("generated client returned the wrong lease variant for a sandbox");
    };
    let value = |raw: &str| alien_core::BindingValue::Value(raw.to_string());
    assert_eq!(binding.image_arn, value(SANDBOX_IMAGE_ARN));
    assert_eq!(binding.image_version, value("7"));
    assert_eq!(binding.region, value("us-east-1"));
    assert_eq!(binding.preview_ports, vec![8080, 3000]);
    assert_eq!(binding.idle_pause_seconds, Some(300));
    assert_eq!(binding.max_lifetime_seconds, Some(3600));
    assert!(binding.allow_egress);
    assert_eq!(binding.execution_role_arn, None);
    assert!(binding.egress_connector_arns.is_empty());
    assert_eq!(client_config.account_id, "123456789012");
    assert_eq!(client_config.region, "us-west-2");
    assert!(client_config.service_overrides.is_none());
    let alien_core::AwsCredentials::SessionCredentials {
        access_key_id,
        secret_access_key,
        session_token,
        expires_at: credential_expires_at,
    } = client_config.credentials
    else {
        panic!("generated client returned a non-session AWS credential for a sandbox");
    };
    assert_eq!(access_key_id, "SENTINEL_ACCESS_KEY");
    assert_eq!(secret_access_key, "SENTINEL_SECRET_KEY");
    assert_eq!(session_token, "SENTINEL_SESSION_TOKEN");
    assert_eq!(credential_expires_at, expires_at.to_rfc3339());
    assert_eq!(lease_expires_at.to_rfc3339(), expires_at.to_rfc3339());

    let bindings = RemoteBindings::from_manager_access(
        DEPLOYMENT_ID,
        &manager_url,
        GENERATED_MANAGER_TOKEN,
        expires_at,
    )
    .expect("construct bindings from assigned Manager access");
    let sandbox = bindings
        .sandbox("agent")
        .await
        .expect("resolve the sandbox binding through Manager");
    assert_eq!(
        sandbox.capabilities(),
        alien_core::SandboxCapabilities::for_platform(alien_core::Platform::Aws)
            .expect("AWS has a sandbox backend"),
        "a remote sandbox must expose the same surface as the in-cloud one"
    );
    let debug = format!("{sandbox:?}");
    assert!(
        debug.contains(SANDBOX_IMAGE_ARN) && debug.contains("8080"),
        "the resolved topology should reach the provider: {debug}"
    );
    for secret in [
        "SENTINEL_ACCESS_KEY",
        "SENTINEL_SECRET_KEY",
        "SENTINEL_SESSION_TOKEN",
    ] {
        assert!(
            !debug.contains(secret),
            "a sandbox handle must not render its credential lease"
        );
    }

    assert_eq!(
        requests
            .lock()
            .expect("generated contract requests lock")
            .as_slice(),
        &[sandbox_resolve_request(), sandbox_resolve_request()],
        "a sandbox resolve is resource-scoped, with no selector of its own"
    );
}

/// A ceiling under a name this binding does not know fails the whole lease rather than being
/// dropped from it. The generated binding denies unknown fields, and that is the difference
/// between a loud refusal and a sandbox running without the wall-clock ceiling its declaration
/// asked for. The two names below are what a manager built against an earlier contract sends.
#[tokio::test]
async fn a_sandbox_lease_naming_a_ceiling_the_binding_does_not_know_is_refused() {
    for (current, stale) in [
        ("idlePauseSeconds", "idleSuspendSeconds"),
        ("maxLifetimeSeconds", "sessionTtlSeconds"),
    ] {
        let expires_at = Utc::now() + ChronoDuration::minutes(5);
        let mut body = sandbox_lease_body(expires_at, json!([8080]), true);
        let binding = body["binding"]
            .as_object_mut()
            .expect("the sandbox lease carries a binding object");
        let seconds = binding
            .remove(current)
            .unwrap_or_else(|| panic!("the fixture declares {current}"));
        binding.insert(stale.to_string(), seconds);

        let manager_url = spawn_generated_contract_server(GeneratedContractState {
            response: Arc::new(StdRwLock::new((StatusCode::OK, body))),
            requests: Arc::new(StdMutex::new(Vec::new())),
        })
        .await;
        let bindings = RemoteBindings::from_manager_access(
            DEPLOYMENT_ID,
            &manager_url,
            GENERATED_MANAGER_TOKEN,
            expires_at,
        )
        .expect("construct bindings from assigned Manager access");

        let error = bindings
            .sandbox("agent")
            .await
            .expect_err("a ceiling under an unknown name must not resolve");
        assert_eq!(error.code, "INVALID_RESPONSE_PAYLOAD", "{stale}: {error}");
        let rendered = format!("{error}");
        assert!(
            rendered.contains(stale) && rendered.contains(current),
            "the refusal must name the field it did not expect and the one it wanted: {rendered}"
        );
    }
}

#[tokio::test]
async fn remote_sandbox_lease_is_refused_when_it_declares_restricted_egress() {
    let expires_at = Utc::now() + ChronoDuration::minutes(5);
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        sandbox_lease_body(expires_at, json!([8080]), false),
    )));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response,
        requests: Arc::new(StdMutex::new(Vec::new())),
    })
    .await;
    let bindings = RemoteBindings::from_manager_access(
        DEPLOYMENT_ID,
        &manager_url,
        GENERATED_MANAGER_TOKEN,
        expires_at,
    )
    .expect("construct bindings from assigned Manager access");

    // The remote contract carries no connectors, so `allowEgress: false` describes a sandbox
    // whose sandboxes would start unrouted and reach the internet.
    let error = bindings
        .sandbox("agent")
        .await
        .expect_err("a sandbox declaring restricted egress must not be handed to a caller");
    assert_eq!(error.code, "BINDING_CONFIG_INVALID");
    assert!(
        format!("{error}").contains("egressConnectorArns"),
        "the refusal should name the field it read: {error}"
    );
}

#[tokio::test]
async fn remote_sandbox_lease_is_refused_when_a_preview_port_does_not_fit() {
    let expires_at = Utc::now() + ChronoDuration::minutes(5);
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        sandbox_lease_body(expires_at, json!([70000]), true),
    )));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response,
        requests: Arc::new(StdMutex::new(Vec::new())),
    })
    .await;
    let bindings = RemoteBindings::from_manager_access(
        DEPLOYMENT_ID,
        &manager_url,
        GENERATED_MANAGER_TOKEN,
        expires_at,
    )
    .expect("construct bindings from assigned Manager access");

    // Narrowing 70000 into a port would mint ingress for 4464, which no declaration named.
    let error = bindings
        .sandbox("agent")
        .await
        .expect_err("an out-of-range preview port must refuse the whole lease");
    assert_eq!(error.code, "REMOTE_ACCESS_FAILED");
    let rendered = format!("{error}");
    assert!(
        rendered.contains("previewPorts") && rendered.contains("70000"),
        "the refusal should name the field and the value it read: {rendered}"
    );
}

fn azure_sandbox_lease_body(expires_at: DateTime<Utc>, allow_egress: bool) -> serde_json::Value {
    json!({
        "service": "sandbox-azure",
        "binding": {
            "sandboxGroup": "acme-agent",
            "dataPlaneEndpoint": "https://management.westus2.azuredevcompute.io",
            "region": "westus2",
            "resourceGroup": "acme-rg",
            "diskImage": "ubuntu",
            "allowEgress": allow_egress,
            "idlePauseSeconds": 300,
            "cpu": "1000m",
            "memory": "2048Mi",
            "disk": "20480Mi",
        },
        "clientConfig": {
            "subscriptionId": "00000000-0000-0000-0000-000000000000",
            "tenantId": "11111111-1111-1111-1111-111111111111",
            "region": "westus2",
            "credentials": { "type": "accessToken", "token": "SENTINEL_AZURE_TOKEN" },
        },
        "expiresAt": expires_at.to_rfc3339(),
    })
}

/// Decodes through the **generated** client, the only path a real deployment takes. This catches
/// a manager response variant added without regenerating the OpenAPI spec: hand-written types and
/// the crate's own tests would still pass, but the generated client would have no arm to decode into.
#[tokio::test]
async fn remote_sandbox_decodes_every_declared_field_and_reaches_the_azure_provider() {
    let expires_at = Utc::now() + ChronoDuration::minutes(5);
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        azure_sandbox_lease_body(expires_at, true),
    )));
    let requests = Arc::new(StdMutex::new(Vec::new()));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response,
        requests: requests.clone(),
    })
    .await;

    let manager = DiscoveredManager {
        deployment_id: DEPLOYMENT_ID.to_string(),
        url: reqwest::Url::parse(&manager_url).expect("valid manager URL"),
        http: authenticated_http_client(GENERATED_MANAGER_TOKEN, "generated manager fixture")
            .expect("build generated contract client"),
        refresh_at: expires_at,
        generation: 0,
    };
    let lease = GeneratedManagerBindingResolver
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("agent"),
        )
        .await
        .expect("generated client should decode an Azure sandbox lease");

    let ResolvedRemoteBinding::SandboxAzure {
        binding,
        client_config,
        expires_at: lease_expires_at,
    } = lease
    else {
        panic!("generated client returned the wrong lease variant for an Azure sandbox");
    };
    let value = |raw: &str| alien_core::BindingValue::Value(raw.to_string());
    assert_eq!(binding.sandbox_group, value("acme-agent"));
    assert_eq!(
        binding.data_plane_endpoint,
        value("https://management.westus2.azuredevcompute.io")
    );
    assert_eq!(binding.region, value("westus2"));
    assert_eq!(binding.resource_group, value("acme-rg"));
    assert_eq!(binding.disk_image, value("ubuntu"));
    assert_eq!(binding.egress, alien_core::SandboxEgress::Allow);
    assert_eq!(binding.idle_pause_seconds, Some(300));
    assert_eq!(binding.cpu, Some(value("1000m")));
    assert_eq!(binding.memory, Some(value("2048Mi")));
    assert_eq!(binding.disk, Some(value("20480Mi")));
    assert_eq!(client_config.region.as_deref(), Some("westus2"));
    assert!(client_config.service_overrides.is_none());
    let alien_core::AzureCredentials::AccessToken { token } = client_config.credentials else {
        panic!("an Azure sandbox lease carries an access token");
    };
    assert_eq!(token, "SENTINEL_AZURE_TOKEN");
    assert_eq!(lease_expires_at.timestamp(), expires_at.timestamp());
}

/// A lease claiming restricted egress is refused rather than quietly downgraded — the field is
/// read from the wire, not assumed, so a future change to the manager's rule still gets caught
/// here.
#[tokio::test]
async fn an_azure_sandbox_lease_without_open_egress_is_refused() {
    let expires_at = Utc::now() + ChronoDuration::minutes(5);
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        azure_sandbox_lease_body(expires_at, false),
    )));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response,
        requests: Arc::new(StdMutex::new(Vec::new())),
    })
    .await;

    let manager = DiscoveredManager {
        deployment_id: DEPLOYMENT_ID.to_string(),
        url: reqwest::Url::parse(&manager_url).expect("valid manager URL"),
        http: authenticated_http_client(GENERATED_MANAGER_TOKEN, "generated manager fixture")
            .expect("build generated contract client"),
        refresh_at: expires_at,
        generation: 0,
    };
    let Err(error) = GeneratedManagerBindingResolver
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("agent"),
        )
        .await
    else {
        panic!("a restricted-egress sandbox lease is not usable remotely")
    };
    assert_eq!(error.code, "REMOTE_ACCESS_FAILED", "{error}");
    assert!(
        format!("{error}").contains("egress"),
        "the code is shared with other refusals, so the reason has to be named: {error}"
    );
}

/// The GCP arm of the same contract, decoded through the **generated** client. Both names a
/// sandbox is addressed by — engine and template — must survive the trip: created without the
/// template, a sandbox runs an unpinned image with none of the declared limits or egress applied.
#[tokio::test]
async fn remote_sandbox_decodes_every_declared_field_and_reaches_the_gcp_provider() {
    // Absent is what a manager older than the field sends; it must still decode, as deny.
    for allow_egress in [Some(true), Some(false), None] {
        decode_gcp_sandbox_lease(allow_egress).await;
    }
}

async fn decode_gcp_sandbox_lease(allow_egress: Option<bool>) {
    let expires_at = Utc::now() + ChronoDuration::minutes(5);
    let engine = "projects/acme/locations/us-central1/reasoningEngines/4242";
    let mut binding_json = json!({
        "engine": engine,
        "template": format!("{engine}/sandboxEnvironmentTemplates/7"),
        "region": "us-central1",
        "maxLifetimeSeconds": 3600,
    });
    if let Some(allow) = allow_egress {
        binding_json["allowEgress"] = json!(allow);
    }
    let response = Arc::new(StdRwLock::new((
        StatusCode::OK,
        json!({
            "service": "sandbox-gcp-agent-platform",
            "binding": binding_json,
            "clientConfig": {
                "projectId": "acme",
                "region": "us-central1",
                "credentials": { "type": "accessToken", "token": "SENTINEL_GCP_TOKEN" },
            },
            "expiresAt": expires_at.to_rfc3339(),
        }),
    )));
    let manager_url = spawn_generated_contract_server(GeneratedContractState {
        response,
        requests: Arc::new(StdMutex::new(Vec::new())),
    })
    .await;

    let manager = DiscoveredManager {
        deployment_id: DEPLOYMENT_ID.to_string(),
        url: reqwest::Url::parse(&manager_url).expect("valid manager URL"),
        http: authenticated_http_client(GENERATED_MANAGER_TOKEN, "generated manager fixture")
            .expect("build generated contract client"),
        refresh_at: expires_at,
        generation: 0,
    };
    let lease = GeneratedManagerBindingResolver
        .resolve(
            &manager,
            DEPLOYMENT_ID,
            RemoteBindingSelector::Resource("agent"),
        )
        .await
        .expect("generated client should decode a GCP Agent Platform sandbox lease");

    let ResolvedRemoteBinding::SandboxGcpAgentPlatform {
        binding,
        client_config,
        expires_at: lease_expires_at,
    } = lease
    else {
        panic!("generated client returned the wrong lease variant for a GCP sandbox");
    };
    let value = |raw: &str| alien_core::BindingValue::Value(raw.to_string());
    assert_eq!(binding.engine, value(engine));
    assert_eq!(
        binding.template,
        value(&format!("{engine}/sandboxEnvironmentTemplates/7"))
    );
    assert_eq!(binding.region, value("us-central1"));
    assert_eq!(binding.max_lifetime_seconds, Some(3600));
    assert_eq!(binding.allow_egress, allow_egress.unwrap_or(false));
    assert_eq!(client_config.project_id, "acme");
    assert!(client_config.service_overrides.is_none());
    let alien_core::GcpCredentials::AccessToken { token } = client_config.credentials else {
        panic!("a GCP sandbox lease carries an access token");
    };
    assert_eq!(token, "SENTINEL_GCP_TOKEN");
    assert_eq!(lease_expires_at.timestamp(), expires_at.timestamp());
}