from __future__ import annotations

import pytest

from app.core.mcp.governed_invocation import (
    InvocationContractError,
    normalize_mcp_invocation,
)


def test_mcp_invocation_contract_is_closed_and_rejects_url_path_command_secret_and_confusables():
    valid = normalize_mcp_invocation(
        {
            "interface_type": "mcp",
            "tool_name": "knowledge.search",
            "action": "read",
            "arguments_digest": "a" * 64,
            "evidence_refs": [{"evidence_id": "point-1", "digest": "b" * 64}],
        }
    )
    assert valid["tool_name"] == "knowledge.search"
    for invalid in (
        {"url": "https://example.invalid"},
        {"file_path": "/tmp/data"},
        {"command": "id"},
        {"api_key": "redacted"},
        {"ｅvidence_refs": []},
    ):
        with pytest.raises(InvocationContractError):
            normalize_mcp_invocation({**valid, **invalid})