"""Tests for OAuth 2.0 Resource Indicators utilities."""

from mcp.shared.auth_utils import check_resource_allowed, resource_url_from_server_url


class TestResourceUrlFromServerUrl:
    """Tests for resource_url_from_server_url function."""

    def test_removes_fragment(self):
        """Fragment should be removed per RFC 8707."""
        assert resource_url_from_server_url("https://example.com/path#fragment") == "https://example.com/path"
        assert resource_url_from_server_url("https://example.com/#fragment") == "https://example.com/"

    def test_preserves_path(self):
        """Path should be preserved."""
        assert (
            resource_url_from_server_url("https://example.com/path/to/resource")
            == "https://example.com/path/to/resource"
        )
        assert resource_url_from_server_url("https://example.com/") == "https://example.com/"
        assert resource_url_from_server_url("https://example.com") == "https://example.com"

    def test_preserves_query(self):
        """Query parameters should be preserved."""
        assert resource_url_from_server_url("https://example.com/path?foo=bar") == "https://example.com/path?foo=bar"
        assert resource_url_from_server_url("https://example.com/?key=value") == "https://example.com/?key=value"

    def test_preserves_port(self):
        """Non-default ports should be preserved."""
        assert resource_url_from_server_url("https://example.com:8443/path") == "https://example.com:8443/path"
        assert resource_url_from_server_url("http://example.com:8080/") == "http://example.com:8080/"

    def test_lowercase_scheme_and_host(self):
        """Scheme and host should be lowercase for canonical form."""
        assert resource_url_from_server_url("HTTPS://EXAMPLE.COM/path") == "https://example.com/path"
        assert resource_url_from_server_url("Http://Example.Com:8080/") == "http://example.com:8080/"

    def test_handles_pydantic_urls(self):
        """Should handle Pydantic URL types."""
        from pydantic import HttpUrl

        url = HttpUrl("https://example.com/path")
        assert resource_url_from_server_url(url) == "https://example.com/path"


class TestCheckResourceAllowed:
    """Tests for check_resource_allowed function."""

    def test_identical_urls(self):
        """Identical URLs should match."""
        assert check_resource_allowed("https://example.com/path", "https://example.com/path") is True
        assert check_resource_allowed("https://example.com/", "https://example.com/") is True
        assert check_resource_allowed("https://example.com", "https://example.com") is True

    def test_different_schemes(self):
        """Different schemes should not match."""
        assert check_resource_allowed("https://example.com/path", "http://example.com/path") is False
        assert check_resource_allowed("http://example.com/", "https://example.com/") is False

    def test_different_domains(self):
        """Different domains should not match."""
        assert check_resource_allowed("https://example.com/path", "https://example.org/path") is False
        assert check_resource_allowed("https://sub.example.com/", "https://example.com/") is False

    def test_different_ports(self):
        """Different ports should not match."""
        assert check_resource_allowed("https://example.com:8443/path", "https://example.com/path") is False
        assert check_resource_allowed("https://example.com:8080/", "https://example.com:8443/") is False

    def test_hierarchical_matching(self):
        """Child paths should match parent paths."""
        # Parent resource allows child resources
        assert check_resource_allowed("https://example.com/api/v1/users", "https://example.com/api") is True
        assert check_resource_allowed("https://example.com/api/v1", "https://example.com/api") is True
        assert check_resource_allowed("https://example.com/mcp/server", "https://example.com/mcp") is True

        # Exact match
        assert check_resource_allowed("https://example.com/api", "https://example.com/api") is True

        # Parent cannot use child's token
        assert check_resource_allowed("https://example.com/api", "https://example.com/api/v1") is False
        assert check_resource_allowed("https://example.com/", "https://example.com/api") is False

    def test_path_boundary_matching(self):
        """Path matching should respect boundaries."""
        # Should not match partial path segments
        assert check_resource_allowed("https://example.com/apiextra", "https://example.com/api") is False
        assert check_resource_allowed("https://example.com/api123", "https://example.com/api") is False

        # Should match with trailing slash
        assert check_resource_allowed("https://example.com/api/", "https://example.com/api") is True
        assert check_resource_allowed("https://example.com/api/v1", "https://example.com/api/") is True

    def test_trailing_slash_handling(self):
        """Trailing slashes should be handled correctly."""
        # With and without trailing slashes
        assert check_resource_allowed("https://example.com/api/", "https://example.com/api") is True
        assert check_resource_allowed("https://example.com/api", "https://example.com/api/") is True
        assert check_resource_allowed("https://example.com/api/v1", "https://example.com/api") is True
        assert check_resource_allowed("https://example.com/api/v1", "https://example.com/api/") is True

    def test_case_insensitive_origin(self):
        """Origin comparison should be case-insensitive."""
        assert check_resource_allowed("https://EXAMPLE.COM/path", "https://example.com/path") is True
        assert check_resource_allowed("HTTPS://example.com/path", "https://example.com/path") is True
        assert check_resource_allowed("https://Example.Com:8080/api", "https://example.com:8080/api") is True

    def test_empty_paths(self):
        """Empty paths should be handled correctly."""
        assert check_resource_allowed("https://example.com", "https://example.com") is True
        assert check_resource_allowed("https://example.com/", "https://example.com") is True
        assert check_resource_allowed("https://example.com/api", "https://example.com") is True