"""Tools the generic sweep must not call because they would break the run itself."""

from __future__ import annotations

from pathlib import Path

import pytest
from mcp import Client

from aegis_gitea_mcp.audit import AuditLogger
from aegis_gitea_mcp.server import build_server
from tests.integration.conftest import McpSession, integration_settings
from tests.integration.harness import GiteaInstance
from tests.integration.sweep_plan import EXCLUDED


async def test_delete_current_token_deletes_only_a_throwaway_token(
    gitea: GiteaInstance, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
) -> None:
    assert set(EXCLUDED) == {"gitea_misc_delete_current_token"}
    monkeypatch.setenv("GITEA_URL", gitea.base_url)
    throwaway = gitea.mint_token(gitea.admin_login, gitea.admin_password, ["all"])
    settings = integration_settings(gitea, tmp_path / "state", gitea_token=throwaway)
    audit = AuditLogger(settings.resolved_audit_log_path)
    try:
        async with Client(build_server(settings, audit=audit)) as client:
            session = McpSession(client, settings.resolved_audit_log_path)
            current = await session.ok("gitea_misc_get_current_token")
            assert "all" in current.data["scopes"]
            assert gitea.api("GET", "/user", token=throwaway).status_code == 200

            deleted = await session.ok("gitea_misc_delete_current_token")
            assert deleted.data is None
            assert throwaway not in session.audit_text()

            # The token is gone: Gitea now refuses it, while the harness admin token lives on.
            assert gitea.api("GET", "/user", token=throwaway).status_code == 401
            assert gitea.api("GET", "/user").status_code == 200
            again = await session.call("gitea_misc_get_current_token")
            assert again.is_error and again.status == 401
            assert throwaway not in again.text
    finally:
        audit.close()