"""Tests for AgentIdentity."""

import pytest

from cyberbrain26.security_plane.identity import (
    AgentIdentity,
    AgentRole,
    PermissionScope,
    TrustLevel,
)


class TestAgentIdentity:
    def test_create_minimal_identity(self) -> None:
        identity = AgentIdentity(agent_id="agent-1", role="coder")
        assert identity.agent_id == "agent-1"
        assert identity.role == "coder"
        assert identity.trust_level == TrustLevel.VERIFIED
        assert identity.scopes == set()
        assert identity.owner is None
        assert identity.metadata == {}

    def test_create_full_identity(self) -> None:
        identity = AgentIdentity(
            agent_id="agent-2",
            role="planner",
            trust_level=TrustLevel.TRUSTED,
            scopes={PermissionScope.READ_FILE, PermissionScope.WRITE_FILE},
            owner="user-1",
            metadata={"provider": "local", "version": "1.0"},
        )
        assert identity.trust_level == TrustLevel.TRUSTED
        assert identity.owner == "user-1"
        assert identity.metadata["provider"] == "local"

    def test_empty_agent_id_raises(self) -> None:
        with pytest.raises(ValueError, match="agent_id must not be empty"):
            AgentIdentity(agent_id="", role="coder")

    def test_empty_role_raises(self) -> None:
        with pytest.raises(ValueError, match="role must not be empty"):
            AgentIdentity(agent_id="agent-1", role="")

    def test_has_scope_true(self) -> None:
        identity = AgentIdentity(
            agent_id="a1", role="coder", scopes={PermissionScope.READ_FILE}
        )
        assert identity.has_scope("read_file") is True

    def test_has_scope_false(self) -> None:
        identity = AgentIdentity(agent_id="a1", role="coder")
        assert identity.has_scope("read_file") is False

    def test_has_any_scope_partial_match(self) -> None:
        identity = AgentIdentity(
            agent_id="a1", role="coder", scopes={PermissionScope.READ_FILE}
        )
        assert identity.has_any_scope({"read_file", "write_file"}) is True
        assert identity.has_any_scope({"write_file", "delete_file"}) is False

    def test_can_read_file(self) -> None:
        identity = AgentIdentity(
            agent_id="a1", role="coder", scopes={PermissionScope.READ_FILE}
        )
        assert identity.can_read_file() is True
        assert identity.can_write_file() is False

    def test_can_execute_shell(self) -> None:
        identity = AgentIdentity(
            agent_id="a1",
            role="coder",
            scopes={PermissionScope.SHELL, PermissionScope.PYTHON},
        )
        assert identity.can_execute_shell() is True

    def test_can_access_network(self) -> None:
        identity = AgentIdentity(
            agent_id="a1",
            role="research",
            scopes={PermissionScope.NETWORK},
        )
        assert identity.can_access_network() is True

    def test_can_access_secrets(self) -> None:
        identity = AgentIdentity(
            agent_id="a1",
            role="security",
            scopes={PermissionScope.SECRETS},
        )
        assert identity.can_access_secrets() is True

    def test_is_trusted_official(self) -> None:
        identity = AgentIdentity(
            agent_id="a1", role="coder", trust_level=TrustLevel.OFFICIAL
        )
        assert identity.is_trusted() is True

    def test_is_trusted_trusted(self) -> None:
        identity = AgentIdentity(
            agent_id="a1", role="coder", trust_level=TrustLevel.TRUSTED
        )
        assert identity.is_trusted() is True

    def test_is_trusted_verified(self) -> None:
        identity = AgentIdentity(
            agent_id="a1", role="coder", trust_level=TrustLevel.VERIFIED
        )
        assert identity.is_trusted() is False

    def test_is_trusted_untrusted(self) -> None:
        identity = AgentIdentity(
            agent_id="a1", role="coder", trust_level=TrustLevel.UNTRUSTED
        )
        assert identity.is_trusted() is False

    def test_custom_role_string(self) -> None:
        identity = AgentIdentity(agent_id="a1", role="custom_role")
        assert identity.role == "custom_role"

    def test_metadata_can_be_mutated(self) -> None:
        identity = AgentIdentity(agent_id="a1", role="coder")
        identity.metadata["note"] = "test"
        assert identity.metadata["note"] == "test"

    def test_scopes_can_be_mutated(self) -> None:
        identity = AgentIdentity(agent_id="a1", role="coder")
        identity.scopes.add(PermissionScope.NETWORK)
        assert identity.has_scope("network") is True


class TestTrustLevel:
    def test_values(self) -> None:
        assert TrustLevel.UNTRUSTED.value == "untrusted"
        assert TrustLevel.VERIFIED.value == "verified"
        assert TrustLevel.TRUSTED.value == "trusted"
        assert TrustLevel.OFFICIAL.value == "official"


class TestPermissionScope:
    def test_values(self) -> None:
        assert PermissionScope.READ_FILE.value == "read_file"
        assert PermissionScope.WRITE_FILE.value == "write_file"
        assert PermissionScope.SHELL.value == "shell"
        assert PermissionScope.SECRETS.value == "secrets"


class TestAgentRole:
    def test_values(self) -> None:
        assert AgentRole.PLANNER.value == "planner"
        assert AgentRole.CODER.value == "coder"
        assert AgentRole.SECURITY.value == "security"