pulse/internal/api/agent_resource_context_test.go

package api

import (
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"github.com/rcourtman/pulse-go-rewrite/internal/ai/approval"
	"github.com/rcourtman/pulse-go-rewrite/internal/config"
	"github.com/rcourtman/pulse-go-rewrite/internal/models"
	unified "github.com/rcourtman/pulse-go-rewrite/internal/unifiedresources"
)

// staticFindingsProvider is a tiny test double for AgentFindingsProvider
// — keyed by resource id so each test can stage the snapshot it
// expects to see in the bundle.
type staticFindingsProvider struct {
	byResource map[string][]AgentResourceFindingSnapshot
}

func (s staticFindingsProvider) ActiveFindingsForResource(resourceID string) []AgentResourceFindingSnapshot {
	if s.byResource == nil {
		return nil
	}
	return s.byResource[resourceID]
}

// staticApprovalsProvider is a tiny test double for
// AgentApprovalsProvider — keyed by (resource id, org id) so each
// test can stage the pending approvals it expects to see in the
// bundle without setting up a global approval store.
type staticApprovalsProvider struct {
	byResource map[string][]AgentResourceApprovalSummary
}

func (s staticApprovalsProvider) PendingApprovalsForResource(resourceID, _ string) []AgentResourceApprovalSummary {
	if s.byResource == nil {
		return nil
	}
	return s.byResource[resourceID]
}

func (s staticApprovalsProvider) PendingApprovalCountsByResource(_ string) map[string]int {
	if s.byResource == nil {
		return nil
	}
	counts := map[string]int{}
	for resourceID, pending := range s.byResource {
		if len(pending) > 0 {
			counts[resourceID] = len(pending)
		}
	}
	if len(counts) == 0 {
		return nil
	}
	return counts
}

type countingApprovalsProvider struct {
	staticApprovalsProvider
	resourceCalls int
	countCalls    int
}

func (p *countingApprovalsProvider) PendingApprovalsForResource(resourceID, orgID string) []AgentResourceApprovalSummary {
	p.resourceCalls++
	return p.staticApprovalsProvider.PendingApprovalsForResource(resourceID, orgID)
}

func (p *countingApprovalsProvider) PendingApprovalCountsByResource(orgID string) map[string]int {
	p.countCalls++
	return p.staticApprovalsProvider.PendingApprovalCountsByResource(orgID)
}

type staticResourceDiscoveryReadinessProvider struct {
	byResource map[string]unified.ResourceDiscoveryReadiness
}

func (p staticResourceDiscoveryReadinessProvider) DiscoveryReadinessForResource(resource unified.Resource, now time.Time) unified.ResourceDiscoveryReadiness {
	if readiness, ok := p.byResource[unified.CanonicalResourceID(resource.ID)]; ok {
		if readiness.GeneratedAt.IsZero() {
			readiness.GeneratedAt = now
		}
		if readiness.ResourceType == "" && resource.DiscoveryTarget != nil {
			readiness.ResourceType = resource.DiscoveryTarget.ResourceType
		}
		if readiness.TargetID == "" && resource.DiscoveryTarget != nil {
			readiness.TargetID = resource.DiscoveryTarget.AgentID
		}
		if readiness.ResourceID == "" && resource.DiscoveryTarget != nil {
			readiness.ResourceID = resource.DiscoveryTarget.ResourceID
		}
		return readiness
	}
	readiness := unified.ResourceDiscoveryReadiness{
		State:       unified.ResourceDiscoveryReadinessMissing,
		Source:      "service-discovery",
		GeneratedAt: now,
	}
	if resource.DiscoveryTarget != nil {
		readiness.ResourceType = resource.DiscoveryTarget.ResourceType
		readiness.TargetID = resource.DiscoveryTarget.AgentID
		readiness.ResourceID = resource.DiscoveryTarget.ResourceID
	}
	return readiness
}

// agentContextFixtureHandlers wires a ResourceHandlers around a
// pre-built unified-resource seed (using the same
// `resourceUnifiedSeedProvider` pattern from resources_test.go) plus
// the agent context handler with a findings-provider stub. The seed
// provider bypasses the snapshot → unified adapter, letting us stage
// exactly the resource the test expects to see in the bundle.
func agentContextFixtureHandlersForResource(t *testing.T, resource unified.Resource) (*AgentContextHandler, *staticFindingsProvider) {
	t.Helper()
	cfg := &config.Config{DataPath: t.TempDir()}
	resources := NewResourceHandlers(cfg)
	resources.SetStateProvider(resourceUnifiedSeedProvider{
		snapshot:  models.StateSnapshot{LastUpdate: time.Now()},
		resources: []unified.Resource{resource},
	})
	provider := &staticFindingsProvider{byResource: map[string][]AgentResourceFindingSnapshot{}}
	h := NewAgentContextHandler(resources)
	h.SetFindingsProvider(provider)
	return h, provider
}

func agentContextFixtureHandlers(t *testing.T, resourceID string) (*AgentContextHandler, *staticFindingsProvider) {
	t.Helper()
	return agentContextFixtureHandlersForResource(t, unified.Resource{
		ID:   resourceID,
		Type: "vm",
		Name: "db-01",
	})
}

func findAgentContextSection(sections []AgentResourceContextSection, id string) (AgentResourceContextSection, bool) {
	for _, section := range sections {
		if section.ID == id {
			return section, true
		}
	}
	return AgentResourceContextSection{}, false
}

func findAgentContextFact(section AgentResourceContextSection, label string) (AgentResourceContextFact, bool) {
	for _, fact := range section.Facts {
		if fact.Label == label {
			return fact, true
		}
	}
	return AgentResourceContextFact{}, false
}

func TestHandleAgentResourceContext_BundlesIdentityOperatorStateAndFindings(t *testing.T) {
	h, findings := agentContextFixtureHandlers(t, "vm:101")

	// Stage operator state — server should compute
	// MaintenanceWindowActive once and surface it on the wire so agents
	// don't re-evaluate timestamps client-side.
	store, err := h.resources.getStore("default")
	if err != nil {
		t.Fatalf("getStore: %v", err)
	}
	start := time.Now().Add(-time.Hour)
	end := time.Now().Add(time.Hour)
	if err := store.SetResourceOperatorState(unified.ResourceOperatorState{
		CanonicalID:        "vm:101",
		NeverAutoRemediate: true,
		MaintenanceStartAt: &start,
		MaintenanceEndAt:   &end,
		MaintenanceReason:  "Q3 storage upgrade",
		Criticality:        unified.CriticalityHigh,
		SetAt:              time.Now().UTC(),
		SetBy:              "operator:richard",
	}); err != nil {
		t.Fatalf("SetResourceOperatorState: %v", err)
	}

	// Stage two active findings the provider would return.
	findings.byResource["vm:101"] = []AgentResourceFindingSnapshot{
		{
			ID:              "f-cpu",
			Title:           "CPU saturated",
			Severity:        "warning",
			Category:        "performance",
			Impact:          "Workload stalls until pressure clears.",
			Recommendation:  "Restart workload service.",
			RegressionCount: 2,
			Confidence:      "medium",
		},
		{
			ID:       "f-disk",
			Title:    "Disk pressure",
			Severity: "critical",
		},
	}

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/vm:101", nil)
	req = req.WithContext(context.WithValue(req.Context(), OrgIDContextKey, "default"))
	h.HandleResourceContext(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200; got %d body=%s", rec.Code, rec.Body.String())
	}
	var bundle AgentResourceContext
	if err := json.Unmarshal(rec.Body.Bytes(), &bundle); err != nil {
		t.Fatalf("unmarshal bundle: %v", err)
	}

	// Identity round-trips.
	if bundle.CanonicalID != "vm:101" {
		t.Errorf("canonical id: got %q want vm:101", bundle.CanonicalID)
	}
	if bundle.ResourceName != "db-01" {
		t.Errorf("resource name: got %q want db-01", bundle.ResourceName)
	}
	if bundle.ResourceType != "vm" {
		t.Errorf("resource type: got %q want vm", bundle.ResourceType)
	}

	// Operator-state projected with computed maintenance-active flag.
	if bundle.OperatorState == nil {
		t.Fatal("operator state must be present")
	}
	if !bundle.OperatorState.NeverAutoRemediate {
		t.Error("never_auto_remediate must round-trip")
	}
	if !bundle.OperatorState.MaintenanceWindowActive {
		t.Error("MaintenanceWindowActive must be true when window covers now (computed server-side, not by the agent)")
	}
	if bundle.OperatorState.Criticality != "high" {
		t.Errorf("criticality: got %q want high", bundle.OperatorState.Criticality)
	}

	// Findings come through the provider verbatim — no leakage of
	// internal Finding shape.
	if len(bundle.ActiveFindings) != 2 {
		t.Fatalf("expected 2 findings; got %d", len(bundle.ActiveFindings))
	}
	if bundle.ActiveFindings[0].Confidence != "medium" {
		t.Errorf("confidence must round-trip; got %q", bundle.ActiveFindings[0].Confidence)
	}
	if bundle.ActiveFindings[0].RegressionCount != 2 {
		t.Errorf("regression count must round-trip; got %d", bundle.ActiveFindings[0].RegressionCount)
	}

	// Generated timestamp populated so agents can age the data.
	if bundle.GeneratedAt.IsZero() {
		t.Error("GeneratedAt must be populated")
	}
	if len(bundle.ContextSections) == 0 {
		t.Fatal("contextSections must be populated for resource-aware agents")
	}
	if section, ok := findAgentContextSection(bundle.ContextSections, "identity"); !ok {
		t.Fatal("identity context section missing")
	} else if section.Source == "" || section.TrustTier == "" || section.GeneratedAt.IsZero() {
		t.Fatalf("identity section must carry provenance and freshness metadata: %+v", section)
	}
}

func TestHandleAgentResourceContext_IncludesDiscoveryReadiness(t *testing.T) {
	observedAt := time.Date(2026, 6, 4, 10, 30, 0, 0, time.UTC)
	resourceID := "vm:node-a:101"
	h, _ := agentContextFixtureHandlersForResource(t, unified.Resource{
		ID:        resourceID,
		Type:      unified.ResourceTypeVM,
		Name:      "homeassistant",
		Status:    unified.StatusOnline,
		LastSeen:  observedAt,
		UpdatedAt: observedAt,
		Proxmox: &unified.ProxmoxData{
			NodeName:      "node-a",
			VMID:          101,
			LinkedAgentID: "agent-a",
		},
	})
	h.resources.SetDiscoveryReadinessProvider(staticResourceDiscoveryReadinessProvider{
		byResource: map[string]unified.ResourceDiscoveryReadiness{
			resourceID: {
				State:             unified.ResourceDiscoveryReadinessFresh,
				Source:            "service-discovery",
				ObservedAt:        &observedAt,
				AgeSeconds:        120,
				StaleAfterSeconds: int64((30 * 24 * time.Hour).Seconds()),
				FactCount:         7,
				ServiceName:       "Home Assistant",
				ServiceCategory:   "home_automation",
				Confidence:        0.91,
			},
		},
	})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/"+resourceID, nil)
	h.HandleResourceContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200; got %d body=%s", rec.Code, rec.Body.String())
	}
	var bundle AgentResourceContext
	if err := json.Unmarshal(rec.Body.Bytes(), &bundle); err != nil {
		t.Fatalf("unmarshal bundle: %v", err)
	}
	if bundle.DiscoveryReadiness == nil || bundle.DiscoveryReadiness.State != unified.ResourceDiscoveryReadinessFresh {
		t.Fatalf("discovery readiness = %+v, want fresh", bundle.DiscoveryReadiness)
	}

	runtimeSection, ok := findAgentContextSection(bundle.ContextSections, "runtime")
	if !ok {
		t.Fatal("runtime section missing")
	}
	readinessFact, ok := findAgentContextFact(runtimeSection, "Discovery readiness")
	if !ok {
		t.Fatal("Discovery readiness fact missing")
	}
	if !strings.Contains(readinessFact.Value, "fresh") || !strings.Contains(readinessFact.Value, "staleAfter=") {
		t.Fatalf("readiness fact value = %q", readinessFact.Value)
	}
	if readinessFact.Source != "service-discovery" || readinessFact.TrustTier != "pulse-authored" {
		t.Fatalf("readiness fact provenance = source %q trust %q", readinessFact.Source, readinessFact.TrustTier)
	}
	serviceFact, ok := findAgentContextFact(runtimeSection, "Discovered service")
	if !ok || serviceFact.TrustTier != "discovered" {
		t.Fatalf("discovered service fact = %+v", serviceFact)
	}
	if serviceFact.Value != "Home Assistant" && serviceFact.Value != unified.ResourcePolicyRedactedLabel {
		t.Fatalf("discovered service value = %q, want service name or policy redaction", serviceFact.Value)
	}
}

func TestHandleAgentResourceContext_ResolvesSourceIDReference(t *testing.T) {
	h, _ := agentContextFixtureHandlersForResource(t, unified.Resource{
		ID:         "system-container-6adaf34f529d241a",
		Type:       unified.ResourceTypeSystemContainer,
		Technology: "lxc",
		Name:       "homeassistant",
		Status:     unified.StatusOnline,
		Sources:    []unified.DataSource{unified.SourceProxmox},
		Proxmox: &unified.ProxmoxData{
			SourceID:      "delly:delly:101",
			NodeName:      "delly",
			Instance:      "delly",
			VMID:          101,
			ContainerType: "lxc",
		},
		DiscoveryTarget: &unified.DiscoveryTarget{
			ResourceType: "system-container",
			AgentID:      "delly",
			ResourceID:   "101",
			Hostname:     "homeassistant",
		},
	})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/delly:delly:101", nil)
	h.HandleResourceContext(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200; got %d body=%s", rec.Code, rec.Body.String())
	}
	var bundle AgentResourceContext
	if err := json.Unmarshal(rec.Body.Bytes(), &bundle); err != nil {
		t.Fatalf("unmarshal bundle: %v", err)
	}
	if bundle.CanonicalID != "system-container-6adaf34f529d241a" {
		t.Fatalf("canonical id = %q, want registered unified resource id", bundle.CanonicalID)
	}
	if bundle.ResourceName != "homeassistant" || bundle.ResourceType != "system-container" {
		t.Fatalf("bundle resource = %s/%s, want homeassistant/system-container", bundle.ResourceName, bundle.ResourceType)
	}
}

func TestHandleAgentResourceContext_UsesLinkedNodeAgentForProxmoxGuestDiscovery(t *testing.T) {
	parentID := "agent-delly"
	resources := NewResourceHandlers(&config.Config{DataPath: t.TempDir()})
	resources.SetStateProvider(resourceUnifiedSeedProvider{
		snapshot: models.StateSnapshot{LastUpdate: time.Now()},
		resources: []unified.Resource{
			{
				ID:     parentID,
				Type:   unified.ResourceTypeAgent,
				Name:   "delly",
				Status: unified.StatusOnline,
				Sources: []unified.DataSource{
					unified.SourceAgent,
				},
				Agent: &unified.AgentData{
					AgentID:  "agent-delly",
					Hostname: "delly",
				},
			},
			{
				ID:       "system-container-homeassistant",
				Type:     unified.ResourceTypeSystemContainer,
				Name:     "homeassistant",
				Status:   unified.StatusOnline,
				ParentID: &parentID,
				Sources: []unified.DataSource{
					unified.SourceProxmox,
				},
				Proxmox: &unified.ProxmoxData{
					SourceID:      "delly:delly:101",
					NodeName:      "delly",
					Instance:      "delly",
					VMID:          101,
					ContainerType: "lxc",
				},
			},
		},
	})
	resources.SetDiscoveryReadinessProvider(staticResourceDiscoveryReadinessProvider{})
	h := NewAgentContextHandler(resources)

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/delly:delly:101", nil)
	h.HandleResourceContext(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200; got %d body=%s", rec.Code, rec.Body.String())
	}
	var bundle AgentResourceContext
	if err := json.Unmarshal(rec.Body.Bytes(), &bundle); err != nil {
		t.Fatalf("unmarshal bundle: %v", err)
	}
	if bundle.CanonicalID != "system-container-homeassistant" {
		t.Fatalf("canonical id = %q, want system-container-homeassistant", bundle.CanonicalID)
	}
	if bundle.DiscoveryReadiness == nil {
		t.Fatal("expected discovery readiness in context bundle")
	}
	if bundle.DiscoveryReadiness.State != unified.ResourceDiscoveryReadinessMissing {
		t.Fatalf("readiness state = %q, want missing", bundle.DiscoveryReadiness.State)
	}
	if bundle.DiscoveryReadiness.ResourceType != "system-container" ||
		bundle.DiscoveryReadiness.TargetID != "agent-delly" ||
		bundle.DiscoveryReadiness.ResourceID != "101" {
		t.Fatalf("readiness target mismatch: %+v", bundle.DiscoveryReadiness)
	}
	runtime, ok := findAgentContextSection(bundle.ContextSections, "runtime")
	if !ok {
		t.Fatalf("expected runtime section in context bundle: %+v", bundle.ContextSections)
	}
	if _, ok := findAgentContextFact(runtime, "Discovery readiness"); !ok {
		t.Fatalf("runtime section must include discovery readiness fact: %+v", runtime.Facts)
	}
}

func TestHandleAgentResourceContext_ContextSectionsIncludeRuntimeTopologyAndRecentChanges(t *testing.T) {
	now := time.Now().UTC()
	parentID := "agent:pve1"
	h, _ := agentContextFixtureHandlersForResource(t, unified.Resource{
		ID:         "app-container:homeassistant",
		Type:       unified.ResourceTypeAppContainer,
		Name:       "homeassistant",
		Status:     unified.StatusOnline,
		Technology: "docker",
		LastSeen:   now.Add(-time.Minute),
		UpdatedAt:  now,
		ParentID:   &parentID,
		ParentName: "ha-lxc",
		DiscoveryTarget: &unified.DiscoveryTarget{
			ResourceType: "app-container",
			AgentID:      "agent:pve1",
			ResourceID:   "homeassistant",
			Hostname:     "homeassistant.local",
		},
		Docker: &unified.DockerData{
			Runtime:        "docker",
			RuntimeVersion: "27.0",
			ContainerState: "running",
			Health:         "healthy",
			RestartCount:   2,
			Image:          "ghcr.io/home-assistant/home-assistant:stable",
			Ports: []unified.DockerPortMeta{
				{PrivatePort: 8123, PublicPort: 8123, Protocol: "tcp"},
			},
			Mounts: []unified.DockerMountMeta{
				{Source: "/srv/homeassistant/secret-config", Destination: "/config", RW: true},
			},
			Labels: map[string]string{
				"com.example.env": "TOKEN=should-not-leak",
			},
		},
		Relationships: []unified.ResourceRelationship{
			{
				SourceID:   "app-container:homeassistant",
				TargetID:   "agent:pve1",
				Type:       unified.RelRunsOn,
				Confidence: 0.95,
				Active:     true,
				Discoverer: "docker_adapter",
				ObservedAt: now.Add(-2 * time.Minute),
				LastSeenAt: now.Add(-time.Minute),
				Metadata:   map[string]any{"raw": "metadata is intentionally summarized only"},
			},
		},
		Capabilities: []unified.ResourceCapability{
			{
				Name:                 "restart_container",
				MinimumApprovalLevel: unified.ApprovalAdmin,
				Platform:             "docker",
				Params: []unified.CapabilityParam{
					{Name: "token", IsSensitive: true},
				},
			},
		},
	})
	store, err := h.resources.getStore("default")
	if err != nil {
		t.Fatalf("getStore: %v", err)
	}
	if err := store.RecordChange(unified.ResourceChange{
		ID:            "change-ha-restart",
		ResourceID:    "app-container:homeassistant",
		ObservedAt:    now.Add(-30 * time.Second),
		Kind:          unified.ChangeRestart,
		From:          "running",
		To:            "restarted",
		SourceType:    unified.SourcePulseDiff,
		SourceAdapter: unified.AdapterDocker,
		Confidence:    unified.ConfidenceHigh,
		Reason:        "container restarted after update",
	}); err != nil {
		t.Fatalf("RecordChange: %v", err)
	}

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/app-container:homeassistant", nil)
	h.HandleResourceContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200; got %d body=%s", rec.Code, rec.Body.String())
	}
	var bundle AgentResourceContext
	if err := json.Unmarshal(rec.Body.Bytes(), &bundle); err != nil {
		t.Fatalf("unmarshal bundle: %v", err)
	}

	runtimeSection, ok := findAgentContextSection(bundle.ContextSections, "runtime")
	if !ok {
		t.Fatalf("runtime section missing from context pack: %+v", bundle.ContextSections)
	}
	if fact, ok := findAgentContextFact(runtimeSection, "Ports"); !ok || !strings.Contains(fact.Value, "8123:8123/tcp") {
		t.Fatalf("runtime ports fact missing or wrong: %+v", fact)
	}
	if fact, ok := findAgentContextFact(runtimeSection, "Mounts"); !ok || fact.Value != "1" {
		t.Fatalf("runtime must include mount count without path values; got %+v", fact)
	}

	topologySection, ok := findAgentContextSection(bundle.ContextSections, "topology")
	if !ok {
		t.Fatal("topology section missing from context pack")
	}
	if fact, ok := findAgentContextFact(topologySection, "Relationship 1"); !ok || !strings.Contains(fact.Value, "runs_on") || !strings.Contains(fact.Value, "metadata present") {
		t.Fatalf("relationship fact missing bounded topology summary: %+v", fact)
	}

	safetySection, ok := findAgentContextSection(bundle.ContextSections, "safety")
	if !ok {
		t.Fatal("safety section missing from context pack")
	}
	if fact, ok := findAgentContextFact(safetySection, "Capability 1"); !ok || !strings.Contains(fact.Value, "1 sensitive params hidden") {
		t.Fatalf("capability fact must hide sensitive params: %+v", fact)
	}

	changesSection, ok := findAgentContextSection(bundle.ContextSections, "recent_changes")
	if !ok {
		t.Fatal("recent_changes section missing from context pack")
	}
	if fact, ok := findAgentContextFact(changesSection, "Change 1"); !ok || !strings.Contains(fact.Value, "container restarted after update") {
		t.Fatalf("recent change fact missing canonical timeline context: %+v", fact)
	}

	body := rec.Body.String()
	for _, forbidden := range []string{"/srv/homeassistant/secret-config", "TOKEN=should-not-leak", "metadata is intentionally summarized only"} {
		if strings.Contains(body, forbidden) {
			t.Fatalf("context pack leaked raw unsafe detail %q in body: %s", forbidden, body)
		}
	}
}

func TestHandleAgentResourceContext_ContextSectionsApplyPolicyRedactions(t *testing.T) {
	h, _ := agentContextFixtureHandlersForResource(t, unified.Resource{
		ID:        "storage:dataset-1",
		Type:      unified.ResourceTypeStorage,
		Name:      "dataset-1",
		Status:    unified.StatusOnline,
		LastSeen:  time.Now().UTC(),
		UpdatedAt: time.Now().UTC(),
		Policy: &unified.ResourcePolicy{
			Sensitivity: unified.ResourceSensitivitySensitive,
			Routing: unified.ResourceRoutingPolicy{
				Scope: unified.ResourceRoutingScopeLocalOnly,
				Redact: []unified.ResourceRedactionHint{
					unified.ResourceRedactionHostname,
					unified.ResourceRedactionPath,
					unified.ResourceRedactionPlatformID,
				},
			},
		},
		AISafeSummary: "storage resource; status online; local-only context",
		DiscoveryTarget: &unified.DiscoveryTarget{
			ResourceType: "storage",
			AgentID:      "agent-secret-id",
			ResourceID:   "storage-secret-id",
			Hostname:     "secret-storage.local",
		},
		Storage: &unified.StorageMeta{
			Type:        "zfs",
			Path:        "/mnt/secret-dataset",
			RiskSummary: "secret-storage.local has elevated writes",
		},
	})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/storage:dataset-1", nil)
	h.HandleResourceContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200; got %d body=%s", rec.Code, rec.Body.String())
	}
	var bundle AgentResourceContext
	if err := json.Unmarshal(rec.Body.Bytes(), &bundle); err != nil {
		t.Fatalf("unmarshal bundle: %v", err)
	}

	runtimeSection, ok := findAgentContextSection(bundle.ContextSections, "runtime")
	if !ok {
		t.Fatal("runtime section missing")
	}
	for _, label := range []string{"Discovery hostname", "Storage path"} {
		fact, ok := findAgentContextFact(runtimeSection, label)
		if !ok {
			t.Fatalf("%s fact missing", label)
		}
		if fact.Value != unified.ResourcePolicyRedactedLabel || !fact.Redacted {
			t.Fatalf("%s must be explicitly redacted by policy; got %+v", label, fact)
		}
	}
	policySection, ok := findAgentContextSection(bundle.ContextSections, "policy")
	if !ok || len(policySection.Redactions) == 0 {
		t.Fatalf("policy section must explain redactions; got %+v", policySection)
	}
	body := rec.Body.String()
	for _, forbidden := range []string{"secret-storage.local", "/mnt/secret-dataset"} {
		if strings.Contains(body, forbidden) {
			t.Fatalf("context pack leaked policy-redacted value %q in body: %s", forbidden, body)
		}
	}
}

func TestHandleAgentResourceContext_OperatorStateAbsentWhenNoEntry(t *testing.T) {
	// A resource with no operator state recorded must omit the
	// operatorState field entirely (omitempty), distinguishing "no
	// operator overrides" from "operator overrides happen to be all
	// zero." Agents branch on field presence rather than value.
	h, _ := agentContextFixtureHandlers(t, "vm:fresh")

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/vm:fresh", nil)
	h.HandleResourceContext(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200; got %d body=%s", rec.Code, rec.Body.String())
	}
	var raw map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &raw); err != nil {
		t.Fatalf("unmarshal: %v", err)
	}
	if _, has := raw["operatorState"]; has {
		t.Errorf("operatorState must be omitted when no entry exists; got %v", raw["operatorState"])
	}
	// Active findings must be an empty array (not null), so agents can
	// iterate without nil-checking the field.
	if findings, ok := raw["activeFindings"].([]any); !ok {
		t.Errorf("activeFindings must be an array; got %T", raw["activeFindings"])
	} else if len(findings) != 0 {
		t.Errorf("expected empty findings array; got %d", len(findings))
	}
}

func TestHandleAgentResourceContext_404OnUnknownResource(t *testing.T) {
	h, _ := agentContextFixtureHandlers(t, "vm:101")

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/vm:nonexistent", nil)
	h.HandleResourceContext(rec, req)

	if rec.Code != http.StatusNotFound {
		t.Fatalf("expected 404; got %d", rec.Code)
	}
	var body map[string]string
	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
		t.Fatalf("unmarshal error body: %v", err)
	}
	if body["error"] != "resource_not_found" {
		t.Errorf("expected error=resource_not_found; got %v", body)
	}
}

func TestHandleAgentResourceContext_RejectsNonGet(t *testing.T) {
	h, _ := agentContextFixtureHandlers(t, "vm:101")
	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodPost, "/api/agent/resource-context/vm:101", nil)
	h.HandleResourceContext(rec, req)
	if rec.Code != http.StatusMethodNotAllowed {
		t.Fatalf("expected 405; got %d", rec.Code)
	}
}

func TestHandleAgentResourceContext_RecentActionsCarryRefusalTokens(t *testing.T) {
	// Refused dispatches (resource_remediation_locked:, plan_drift:)
	// must surface verbatim in the recent-actions slice so agents can
	// branch on the stable token without parsing human messages. Pin
	// this to keep the agent-paradigm contract honest — Pulse already
	// records these refusals as Failed audit records (slices 17, 33);
	// this test verifies the bundle exposes them.
	h, _ := agentContextFixtureHandlers(t, "vm:locked")

	store, err := h.resources.getStore("default")
	if err != nil {
		t.Fatalf("getStore: %v", err)
	}
	now := time.Now().UTC()
	plan := unified.ActionPlan{
		ActionID:  "act-refused",
		RequestID: "req-refused",
		PlannedAt: now,
		ExpiresAt: now.Add(5 * time.Minute),
	}
	if err := store.RecordActionAudit(unified.ActionAuditRecord{
		ID:        "act-refused",
		CreatedAt: now,
		UpdatedAt: now,
		State:     unified.ActionStateFailed,
		Request: unified.ActionRequest{
			RequestID:      "req-refused",
			ResourceID:     "vm:locked",
			CapabilityName: "pulse_control",
			Reason:         "restart workload",
			RequestedBy:    "pulse_patrol",
			Params:         map[string]any{"command": "systemctl restart workload"},
		},
		Plan: plan,
		Result: &unified.ExecutionResult{
			Success:      false,
			ErrorMessage: "resource_remediation_locked: resource is operator-locked against automated remediation",
		},
	}); err != nil {
		t.Fatalf("RecordActionAudit: %v", err)
	}

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/vm:locked", nil)
	h.HandleResourceContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("expected 200; got %d", rec.Code)
	}
	var bundle AgentResourceContext
	if err := json.Unmarshal(rec.Body.Bytes(), &bundle); err != nil {
		t.Fatalf("unmarshal bundle: %v", err)
	}
	if len(bundle.RecentActions) != 1 {
		t.Fatalf("expected 1 recent action; got %d", len(bundle.RecentActions))
	}
	action := bundle.RecentActions[0]
	if action.State != string(unified.ActionStateFailed) {
		t.Errorf("state: got %q want failed", action.State)
	}
	if action.Success {
		t.Error("Success must be false on refused dispatch")
	}
	if action.ErrorMessage == "" || action.Command == "" {
		t.Errorf("error message and command must round-trip; got %+v", action)
	}
	// Stable token preservation — agents branch on the prefix.
	if !strings.Contains(action.ErrorMessage, "resource_remediation_locked:") {
		t.Errorf("ErrorMessage must preserve the stable refusal token; got %q", action.ErrorMessage)
	}
}

func TestHandleAgentResourceContext_PendingApprovalsAreScopedToResource(t *testing.T) {
	// pendingApprovals must list every still-pending approval
	// targeting the bundle's resource. The provider is the seam that
	// scopes by (resource id, org id) — the bundle handler trusts
	// the provider's filtering. Pin the contract: if the provider
	// returns N entries, the bundle returns N entries with the same
	// agent-stable shape (id, command, riskLevel, requestedBy,
	// requestedAt, expiresAt) and an empty array (never null) when
	// the provider returns nothing.
	h, _ := agentContextFixtureHandlers(t, "vm:101")
	now := time.Now().UTC()
	expires := now.Add(5 * time.Minute)
	h.SetApprovalsProvider(staticApprovalsProvider{
		byResource: map[string][]AgentResourceApprovalSummary{
			"vm:101": {
				{
					ID:          "appr-1",
					Command:     "systemctl restart nginx",
					RiskLevel:   "medium",
					RequestedBy: "ai:patrol",
					RequestedAt: now,
					ExpiresAt:   expires,
				},
			},
		},
	})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/vm:101", nil)
	h.HandleResourceContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status: got %d, body=%s", rec.Code, rec.Body.String())
	}
	var bundle AgentResourceContext
	if err := json.NewDecoder(rec.Body).Decode(&bundle); err != nil {
		t.Fatalf("decode: %v", err)
	}
	if len(bundle.PendingApprovals) != 1 {
		t.Fatalf("PendingApprovals len = %d; want 1; body=%s", len(bundle.PendingApprovals), rec.Body.String())
	}
	got := bundle.PendingApprovals[0]
	if got.ID != "appr-1" {
		t.Errorf("ID: got %q, want %q", got.ID, "appr-1")
	}
	if got.Command != "systemctl restart nginx" {
		t.Errorf("Command did not round-trip: got %q", got.Command)
	}
	if got.RiskLevel != "medium" {
		t.Errorf("RiskLevel did not round-trip: got %q", got.RiskLevel)
	}
	if !got.ExpiresAt.Equal(expires) {
		t.Errorf("ExpiresAt did not round-trip: got %v, want %v", got.ExpiresAt, expires)
	}
}

func TestHandleAgentResourceContext_RedactsCommandsForMonitoringReadTokens(t *testing.T) {
	h, _ := agentContextFixtureHandlers(t, "vm:101")
	now := time.Now().UTC()
	expires := now.Add(5 * time.Minute)
	h.SetApprovalsProvider(staticApprovalsProvider{
		byResource: map[string][]AgentResourceApprovalSummary{
			"vm:101": {
				{
					ID:          "appr-1",
					Command:     "systemctl restart nginx",
					RiskLevel:   "medium",
					RequestedBy: "ai:patrol",
					RequestedAt: now,
					ExpiresAt:   expires,
				},
			},
		},
	})
	store, err := h.resources.getStore("default")
	if err != nil {
		t.Fatalf("getStore: %v", err)
	}
	if err := store.RecordActionAudit(unified.ActionAuditRecord{
		ID:        "act-1",
		CreatedAt: now,
		UpdatedAt: now,
		State:     unified.ActionStateCompleted,
		Request: unified.ActionRequest{
			RequestID:      "req-1",
			ResourceID:     "vm:101",
			CapabilityName: "pulse_control",
			RequestedBy:    "pulse_patrol",
			Params:         map[string]any{"command": "systemctl restart nginx"},
		},
		Result: &unified.ExecutionResult{
			Success: true,
			Verification: &unified.ActionVerificationResult{
				Ran:     true,
				Success: true,
				Command: "systemctl is-active nginx",
				RanAt:   now,
			},
		},
	}); err != nil {
		t.Fatalf("RecordActionAudit: %v", err)
	}

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/vm:101", nil)
	token := &config.APITokenRecord{Scopes: []string{config.ScopeMonitoringRead}}
	attachAPITokenRecord(req, token)

	h.HandleResourceContext(rec, req)

	if rec.Code != http.StatusOK {
		t.Fatalf("status: got %d, body=%s", rec.Code, rec.Body.String())
	}
	var bundle AgentResourceContext
	if err := json.NewDecoder(rec.Body).Decode(&bundle); err != nil {
		t.Fatalf("decode: %v", err)
	}
	if len(bundle.PendingApprovals) != 1 {
		t.Fatalf("PendingApprovals len = %d; want 1", len(bundle.PendingApprovals))
	}
	if got := bundle.PendingApprovals[0]; got.Command != "" || !got.CommandRedacted {
		t.Fatalf("pending approval command must be redacted for monitoring-read token; got %+v", got)
	}
	if len(bundle.RecentActions) != 1 {
		t.Fatalf("RecentActions len = %d; want 1", len(bundle.RecentActions))
	}
	action := bundle.RecentActions[0]
	if action.Command != "" || !action.CommandRedacted {
		t.Fatalf("recent action command must be redacted for monitoring-read token; got %+v", action)
	}
	if action.Verification == nil {
		t.Fatal("expected verification to remain present")
	}
	if action.Verification.Command != "" || !action.Verification.CommandRedacted {
		t.Fatalf("verification command must be redacted for monitoring-read token; got %+v", action.Verification)
	}
}

func TestProjectAgentResourceActionsUsesCanonicalVerification(t *testing.T) {
	ranAt := time.Now().UTC()
	summaries := projectAgentResourceActions([]unified.ActionAuditRecord{
		{
			ID:        "action-resource-canonical-verification",
			CreatedAt: ranAt.Add(-time.Minute),
			UpdatedAt: ranAt,
			State:     unified.ActionStateCompleted,
			Request: unified.ActionRequest{
				ResourceID:     "vm:resource-canonical",
				CapabilityName: "restart_service",
				RequestedBy:    "agent:ops",
			},
			Result: &unified.ExecutionResult{Success: true},
			Verification: &unified.ActionVerificationResult{
				Ran:     true,
				Success: true,
				Command: "systemctl is-active nginx",
				RanAt:   ranAt,
			},
		},
		{
			ID:        "action-resource-unrun-verification",
			CreatedAt: ranAt.Add(-2 * time.Minute),
			UpdatedAt: ranAt.Add(-time.Minute),
			State:     unified.ActionStateCompleted,
			Request: unified.ActionRequest{
				ResourceID:     "vm:resource-unrun",
				CapabilityName: "restart_service",
				RequestedBy:    "agent:ops",
			},
			Result: &unified.ExecutionResult{
				Success: true,
				Verification: &unified.ActionVerificationResult{
					Ran:     false,
					Success: true,
					Command: "should not leak",
					Output:  "sensitive output",
					Note:    "sensitive note",
					RanAt:   ranAt,
				},
			},
		},
	})
	if len(summaries) != 2 {
		t.Fatalf("summaries len = %d, want 2", len(summaries))
	}
	if summaries[0].Verification == nil || summaries[0].Verification.Command != "systemctl is-active nginx" {
		t.Fatalf("top-level canonical verification did not project onto resource summary: %+v", summaries[0].Verification)
	}
	if summaries[1].Verification == nil || summaries[1].Verification.Ran {
		t.Fatalf("expected sanitized ran=false verification, got %+v", summaries[1].Verification)
	}
	if summaries[1].Verification.Command != "" || summaries[1].Verification.Note != "" || !summaries[1].Verification.RanAt.IsZero() || summaries[1].Verification.Success {
		t.Fatalf("resource summary leaked ran=false verification details: %+v", summaries[1].Verification)
	}
}

func TestHandleAgentResourceContext_PendingApprovalsEmptyArrayWhenNone(t *testing.T) {
	// Absent or empty must surface as an empty array, not as a
	// missing field — agents iterate without nil-checking. This
	// mirrors the contract for ActiveFindings and RecentActions.
	h, _ := agentContextFixtureHandlers(t, "vm:404")
	// No approvals provider wired — same observable shape as a
	// provider that returns nil for this resource.

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/resource-context/vm:404", nil)
	h.HandleResourceContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status: got %d", rec.Code)
	}
	body := rec.Body.String()
	if !strings.Contains(body, `"pendingApprovals":[]`) {
		t.Errorf("expected pendingApprovals to surface as empty array; body=%s", body)
	}
}

// fleetFixtureHandlers seeds the registry with a multi-resource set
// so the fleet sweep has something to walk. Mirrors the per-resource
// fixture but with N resources and an explicit findings/approvals
// stub for each.
func fleetFixtureHandlers(t *testing.T, resources []unified.Resource) (*AgentContextHandler, *staticFindingsProvider, *staticApprovalsProvider) {
	t.Helper()
	cfg := &config.Config{DataPath: t.TempDir()}
	rh := NewResourceHandlers(cfg)
	rh.SetStateProvider(resourceUnifiedSeedProvider{
		snapshot:  models.StateSnapshot{LastUpdate: time.Now()},
		resources: resources,
	})
	findings := &staticFindingsProvider{byResource: map[string][]AgentResourceFindingSnapshot{}}
	approvals := &staticApprovalsProvider{byResource: map[string][]AgentResourceApprovalSummary{}}
	h := NewAgentContextHandler(rh)
	h.SetFindingsProvider(findings)
	h.SetApprovalsProvider(approvals)
	return h, findings, approvals
}

func TestHandleAgentFleetContext_RollsUpEveryResource(t *testing.T) {
	// The fleet view must surface one entry per resource in the
	// registry so an agent can scan the whole org in one read. Pin
	// the contract: identity round-trips, count is 1:1 with the
	// registry, list is always an array (never null).
	h, _, _ := fleetFixtureHandlers(t, []unified.Resource{
		{ID: "vm:101", Type: "vm", Name: "db-01"},
		{ID: "container:web-1", Type: "container", Name: "web-1", Technology: "docker"},
	})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/fleet-context", nil)
	h.HandleFleetContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status: got %d, body=%s", rec.Code, rec.Body.String())
	}
	var fleet AgentFleetContext
	if err := json.NewDecoder(rec.Body).Decode(&fleet); err != nil {
		t.Fatalf("decode: %v", err)
	}
	if len(fleet.Resources) != 2 {
		t.Fatalf("Resources len = %d; want 2; body=%s", len(fleet.Resources), rec.Body.String())
	}
	byID := map[string]AgentFleetResourceSummary{}
	for _, s := range fleet.Resources {
		byID[s.CanonicalID] = s
	}
	if got, ok := byID["vm:101"]; !ok || got.ResourceName != "db-01" || got.ResourceType != "vm" {
		t.Errorf("vm:101 entry missing or wrong: %+v", got)
	}
	if got, ok := byID["container:web-1"]; !ok || got.Technology != "docker" {
		t.Errorf("container:web-1 entry missing or wrong technology: %+v", got)
	}
}

func TestHandleAgentFleetContext_CountsFindingsBySeverity(t *testing.T) {
	// Per-severity finding counts are the headline number agents use
	// to triage. Pin the contract: counts roll up correctly across
	// (critical, warning, info) and total is the sum.
	h, findings, _ := fleetFixtureHandlers(t, []unified.Resource{
		{ID: "vm:101", Type: "vm", Name: "db-01"},
	})
	findings.byResource["vm:101"] = []AgentResourceFindingSnapshot{
		{ID: "f1", Severity: "critical"},
		{ID: "f2", Severity: "warning"},
		{ID: "f3", Severity: "warning"},
		{ID: "f4", Severity: "info"},
	}

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/fleet-context", nil)
	h.HandleFleetContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status: got %d", rec.Code)
	}
	var fleet AgentFleetContext
	if err := json.NewDecoder(rec.Body).Decode(&fleet); err != nil {
		t.Fatalf("decode: %v", err)
	}
	if len(fleet.Resources) != 1 {
		t.Fatalf("Resources len = %d; want 1", len(fleet.Resources))
	}
	got := fleet.Resources[0].Findings
	want := AgentFleetFindingCounts{Total: 4, Critical: 1, Warning: 2, Info: 1}
	if got != want {
		t.Errorf("findings counts = %+v; want %+v", got, want)
	}
}

func TestHandleAgentFleetContext_PropagatesPendingApprovalCount(t *testing.T) {
	// pendingApprovalCount must reflect the provider's per-resource
	// count so an agent triaging the fleet sees governance-blocked
	// resources at a glance.
	h, _, approvals := fleetFixtureHandlers(t, []unified.Resource{
		{ID: "vm:101", Type: "vm", Name: "db-01"},
		{ID: "container:web-1", Type: "container", Name: "web-1"},
	})
	approvals.byResource["vm:101"] = []AgentResourceApprovalSummary{
		{ID: "appr-1"},
		{ID: "appr-2"},
	}
	// container:web-1 has no pending approvals — should surface as 0.

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/fleet-context", nil)
	h.HandleFleetContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status: got %d", rec.Code)
	}
	var fleet AgentFleetContext
	if err := json.NewDecoder(rec.Body).Decode(&fleet); err != nil {
		t.Fatalf("decode: %v", err)
	}
	byID := map[string]AgentFleetResourceSummary{}
	for _, s := range fleet.Resources {
		byID[s.CanonicalID] = s
	}
	if got := byID["vm:101"].PendingApprovalCount; got != 2 {
		t.Errorf("vm:101 pendingApprovalCount = %d; want 2", got)
	}
	if got := byID["container:web-1"].PendingApprovalCount; got != 0 {
		t.Errorf("container:web-1 pendingApprovalCount = %d; want 0", got)
	}
}

func TestHandleAgentFleetContext_UsesBulkPendingApprovalCounts(t *testing.T) {
	h, _, _ := fleetFixtureHandlers(t, []unified.Resource{
		{ID: "vm:101", Type: "vm", Name: "db-01"},
		{ID: "vm:202", Type: "vm", Name: "db-02"},
		{ID: "container:web-1", Type: "container", Name: "web-1"},
	})
	approvals := &countingApprovalsProvider{
		staticApprovalsProvider: staticApprovalsProvider{
			byResource: map[string][]AgentResourceApprovalSummary{
				"vm:101": {
					{ID: "appr-1"},
					{ID: "appr-2"},
				},
				"container:web-1": {
					{ID: "appr-3"},
				},
			},
		},
	}
	h.SetApprovalsProvider(approvals)

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/fleet-context", nil)
	h.HandleFleetContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status: got %d, body=%s", rec.Code, rec.Body.String())
	}
	if approvals.countCalls != 1 {
		t.Fatalf("PendingApprovalCountsByResource calls = %d; want 1", approvals.countCalls)
	}
	if approvals.resourceCalls != 0 {
		t.Fatalf("PendingApprovalsForResource calls = %d; want 0", approvals.resourceCalls)
	}
	var fleet AgentFleetContext
	if err := json.NewDecoder(rec.Body).Decode(&fleet); err != nil {
		t.Fatalf("decode: %v", err)
	}
	byID := map[string]AgentFleetResourceSummary{}
	for _, s := range fleet.Resources {
		byID[s.CanonicalID] = s
	}
	if got := byID["vm:101"].PendingApprovalCount; got != 2 {
		t.Errorf("vm:101 pendingApprovalCount = %d; want 2", got)
	}
	if got := byID["vm:202"].PendingApprovalCount; got != 0 {
		t.Errorf("vm:202 pendingApprovalCount = %d; want 0", got)
	}
	if got := byID["container:web-1"].PendingApprovalCount; got != 1 {
		t.Errorf("container:web-1 pendingApprovalCount = %d; want 1", got)
	}
}

func TestHandleAgentFleetContext_EmptyArrayWhenRegistryEmpty(t *testing.T) {
	// Empty registry must surface as `resources: []`, never null —
	// agents iterate without nil-checking. This mirrors the
	// iteration-safe contract the per-resource bundle's sections
	// already follow.
	h, _, _ := fleetFixtureHandlers(t, []unified.Resource{})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/api/agent/fleet-context", nil)
	h.HandleFleetContext(rec, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("status: got %d", rec.Code)
	}
	body := rec.Body.String()
	if !strings.Contains(body, `"resources":[]`) {
		t.Errorf("expected resources to surface as empty array; body=%s", body)
	}
}

func TestHandleAgentFleetContext_RejectsNonGet(t *testing.T) {
	h, _, _ := fleetFixtureHandlers(t, []unified.Resource{})
	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodPost, "/api/agent/fleet-context", nil)
	h.HandleFleetContext(rec, req)
	if rec.Code != http.StatusMethodNotAllowed {
		t.Fatalf("status: got %d, want 405", rec.Code)
	}
}

// pendingApprovalsForResourceFromStore is the named seam the
// router-side AgentApprovalsProvider closure delegates to. The
// next four tests pin the substrate's tenant- and
// resource-isolation property: every approval the bundle returns
// must match BOTH the requested org AND the requested resource.
// Cross-org or cross-resource leaks at this seam would let an
// agent with one org's token see approvals targeting another org's
// infrastructure, which is the multi-tenant property the rest of
// Pulse depends on.

// newApprovalsTestStore builds an in-memory approval store seeded
// with the given approvals. Used as the fixture for each isolation
// test below.
func newApprovalsTestStore(t *testing.T, approvals ...*approval.ApprovalRequest) *approval.Store {
	t.Helper()
	store, err := approval.NewStore(approval.StoreConfig{
		DataDir:            t.TempDir(),
		DefaultTimeout:     5 * time.Minute,
		DisablePersistence: true,
	})
	if err != nil {
		t.Fatalf("approval.NewStore: %v", err)
	}
	for _, req := range approvals {
		if err := store.CreateApproval(req); err != nil {
			t.Fatalf("CreateApproval(%s): %v", req.ID, err)
		}
	}
	return store
}

func TestPendingApprovalsForResource_FiltersByOrg(t *testing.T) {
	// Two orgs each have a pending approval against the same
	// canonical resource id. The filter must return only the org
	// that matches.
	orgA := &approval.ApprovalRequest{
		ID: "appr-org-a", OrgID: "org-a",
		Command: "systemctl restart nginx", TargetType: "agent", TargetID: "host-1", TargetName: "host-1",
	}
	orgB := &approval.ApprovalRequest{
		ID: "appr-org-b", OrgID: "org-b",
		Command: "systemctl restart nginx", TargetType: "agent", TargetID: "host-1", TargetName: "host-1",
	}
	store := newApprovalsTestStore(t, orgA, orgB)

	gotA := pendingApprovalsForResourceFromStore(store, "agent:host-1", "org-a")
	if len(gotA) != 1 || gotA[0].ID != "appr-org-a" {
		t.Errorf("org-a query must return only org-a's approval; got %+v", gotA)
	}
	gotB := pendingApprovalsForResourceFromStore(store, "agent:host-1", "org-b")
	if len(gotB) != 1 || gotB[0].ID != "appr-org-b" {
		t.Errorf("org-b query must return only org-b's approval; got %+v", gotB)
	}
}

func TestPendingApprovalsForResource_FiltersByResource(t *testing.T) {
	// Same org, two approvals against different resources. The
	// filter must return only the one matching the requested
	// canonical resource id, never both.
	a := &approval.ApprovalRequest{
		ID: "appr-vm-101", OrgID: "org-a",
		Command: "systemctl restart nginx", TargetType: "vm", TargetID: "101", TargetName: "vm-101",
	}
	b := &approval.ApprovalRequest{
		ID: "appr-vm-202", OrgID: "org-a",
		Command: "systemctl restart nginx", TargetType: "vm", TargetID: "202", TargetName: "vm-202",
	}
	store := newApprovalsTestStore(t, a, b)

	got := pendingApprovalsForResourceFromStore(store, "vm:101", "org-a")
	if len(got) != 1 || got[0].ID != "appr-vm-101" {
		t.Errorf("vm:101 query must return only that resource's approval; got %+v", got)
	}
}

func TestPendingApprovalsForResource_LegacyEmptyOrgIsDefaultOnly(t *testing.T) {
	// Approvals without OrgID set are treated as default-org per
	// approval.BelongsToOrg. Pin that legacy approvals do not leak
	// into a non-default org's bundle, and that the default-org
	// query sees them.
	legacy := &approval.ApprovalRequest{
		ID:      "appr-legacy",
		Command: "systemctl restart nginx", TargetType: "agent", TargetID: "host-1", TargetName: "host-1",
		// OrgID intentionally empty.
	}
	store := newApprovalsTestStore(t, legacy)

	gotDefault := pendingApprovalsForResourceFromStore(store, "agent:host-1", "default")
	if len(gotDefault) != 1 {
		t.Errorf("default org must see legacy approvals; got %d", len(gotDefault))
	}
	gotOther := pendingApprovalsForResourceFromStore(store, "agent:host-1", "org-other")
	if len(gotOther) != 0 {
		t.Errorf("non-default org must NOT see legacy approvals; got %+v", gotOther)
	}
}

func TestPendingApprovalsForResource_EmptyInputsReturnNil(t *testing.T) {
	// Nil store, empty resource id, and an empty store all return
	// nil. The bundle handler normalizes nil to []
	// AgentResourceApprovalSummary{} so the wire shape stays an
	// array; this function only owns the "no data" case.
	if got := pendingApprovalsForResourceFromStore(nil, "vm:101", "org-a"); got != nil {
		t.Errorf("nil store must return nil; got %+v", got)
	}
	var typedNil *approval.Store
	if got := pendingApprovalsForResourceFromStore(typedNil, "vm:101", "org-a"); got != nil {
		t.Errorf("typed nil store must return nil; got %+v", got)
	}
	store := newApprovalsTestStore(t)
	if got := pendingApprovalsForResourceFromStore(store, "", "org-a"); got != nil {
		t.Errorf("empty resource id must return nil; got %+v", got)
	}
	if got := pendingApprovalsForResourceFromStore(store, "vm:none", "org-a"); got != nil {
		t.Errorf("empty store must return nil; got %+v", got)
	}
}

func TestPendingApprovalCountsByResourceFromStore_EmptyInputsReturnNil(t *testing.T) {
	if got := pendingApprovalCountsByResourceFromStore(nil, "org-a"); got != nil {
		t.Errorf("nil store must return nil; got %+v", got)
	}
	var typedNil *approval.Store
	if got := pendingApprovalCountsByResourceFromStore(typedNil, "org-a"); got != nil {
		t.Errorf("typed nil store must return nil; got %+v", got)
	}
	store := newApprovalsTestStore(t)
	if got := pendingApprovalCountsByResourceFromStore(store, "org-a"); got != nil {
		t.Errorf("empty store must return nil; got %+v", got)
	}
}

func TestPendingApprovalCountsByResourceFromStore_GroupsByOrgAndResource(t *testing.T) {
	store := newApprovalsTestStore(t,
		&approval.ApprovalRequest{
			ID: "appr-org-a-vm-101-a", OrgID: "org-a",
			Command: "systemctl restart nginx", TargetType: "vm", TargetID: "101", TargetName: "vm-101",
		},
		&approval.ApprovalRequest{
			ID: "appr-org-a-vm-101-b", OrgID: "org-a",
			Command: "systemctl restart nginx", TargetType: "vm", TargetID: "101", TargetName: "vm-101",
		},
		&approval.ApprovalRequest{
			ID: "appr-org-a-vm-202", OrgID: "org-a",
			Command: "systemctl restart nginx", TargetType: "vm", TargetID: "202", TargetName: "vm-202",
		},
		&approval.ApprovalRequest{
			ID: "appr-org-b-vm-101", OrgID: "org-b",
			Command: "systemctl restart nginx", TargetType: "vm", TargetID: "101", TargetName: "vm-101",
		},
	)

	got := pendingApprovalCountsByResourceFromStore(store, "org-a")
	if got["vm:101"] != 2 {
		t.Errorf("vm:101 count = %d; want 2", got["vm:101"])
	}
	if got["vm:202"] != 1 {
		t.Errorf("vm:202 count = %d; want 1", got["vm:202"])
	}
	if len(got) != 2 {
		t.Errorf("counts len = %d; want 2; got %+v", len(got), got)
	}

	gotB := pendingApprovalCountsByResourceFromStore(store, "org-b")
	if gotB["vm:101"] != 1 || len(gotB) != 1 {
		t.Errorf("org-b counts = %+v; want only vm:101=1", gotB)
	}
}

func TestExtractAgentResourceContextID(t *testing.T) {
	cases := []struct {
		path string
		want string
	}{
		{"/api/agent/resource-context/vm:101", "vm:101"},
		{"/api/agent/resource-context/vm:101/", "vm:101"},
		{"/api/agent/resource-context/instance:node:200", "instance:node:200"},
		{"/api/agent/resource-context/", ""},
	}
	for _, tc := range cases {
		if got := extractAgentResourceContextID(tc.path); got != tc.want {
			t.Errorf("extractAgentResourceContextID(%q) = %q, want %q", tc.path, got, tc.want)
		}
	}
}