"""Tests for the temporary edge header-trust probe (ACC-10614).

The probe must be inert unless the token is set AND the request presents the matching
X-Edge-Probe header, and it must only ever log (never change the response).
"""

import logging

import pytest
from flask import Flask

from core.hardening.edge_probe import install_edge_probe


class _Config:
    EDGE_PROBE_TOKEN = ''


def _app(token: str) -> Flask:
    app = Flask(__name__)
    cfg = _Config()
    cfg.EDGE_PROBE_TOKEN = token
    install_edge_probe(app, cfg)  # type: ignore[arg-type]

    @app.route('/x')
    def _x() -> str:
        return 'ok'

    return app


def test_disabled_when_token_unset(caplog: pytest.LogCaptureFixture) -> None:
    """No token means no before_request is registered and nothing is logged."""
    app = _app('')
    with caplog.at_level(logging.INFO, logger='core.hardening.edge_probe'):
        resp = app.test_client().get('/x', headers={'X-Edge-Probe': 'anything'})
    assert resp.status_code == 200
    assert 'edge probe' not in caplog.text


def test_logs_only_on_matching_token(caplog: pytest.LogCaptureFixture) -> None:
    """With the token set, only a request carrying the matching header is logged."""
    app = _app('secret-token')
    client = app.test_client()

    with caplog.at_level(logging.INFO, logger='core.hardening.edge_probe'):
        client.get('/x')  # no probe header
        client.get('/x', headers={'X-Edge-Probe': 'wrong'})  # wrong token
    assert 'edge probe' not in caplog.text

    with caplog.at_level(logging.INFO, logger='core.hardening.edge_probe'):
        resp = client.get(
            '/x',
            headers={
                'X-Edge-Probe': 'secret-token',
                'X-Forwarded-For': '203.0.113.9',
                'Orchard-User-Id': 'u-123',
            },
        )
    assert resp.status_code == 200  # response is never altered
    assert 'edge probe' in caplog.text
    assert "x_forwarded_for='203.0.113.9'" in caplog.text
    assert 'u-123' in caplog.text