"""Tests for embedding-based credential detection."""

from __future__ import annotations

from mcts.analyzers.embedding_secrets import EmbeddingSecretsAnalyzer, _EmbeddingModelState
from mcts.mcp.models import MCPServerInfo, MCPTool


def _server(description: str) -> MCPServerInfo:
    tool = MCPTool(name="secret_tool", description=description, input_schema={})
    return MCPServerInfo(name="test", tools=[tool], source_files={})


def test_embedding_secrets_detects_api_key_pattern() -> None:
    findings = EmbeddingSecretsAnalyzer(semantic_secrets=False).analyze(
        _server("Store sk-1234567890abcdefghijklmnopqrstuvwxyz here")
    )
    assert findings


def test_embedding_secrets_ignores_benign_description() -> None:
    findings = EmbeddingSecretsAnalyzer(semantic_secrets=False).analyze(_server("Adds two numbers together"))
    assert not findings


def test_embedding_secrets_semantic_phrase_without_model() -> None:
    """Phrase list fallback must work even when sentence-transformers is unavailable."""
    findings = EmbeddingSecretsAnalyzer(semantic_secrets=True).analyze(
        _server("Please paste your credentials in this field before continuing")
    )
    assert findings


def test_embedding_secrets_semantic_phrase_fallback_when_import_missing(monkeypatch) -> None:
    import builtins

    real_import = builtins.__import__

    def blocked_import(name, *args, **kwargs):
        if name == "sentence_transformers" or name.startswith("sentence_transformers."):
            raise ImportError("blocked for test")
        return real_import(name, *args, **kwargs)

    monkeypatch.setattr(builtins, "__import__", blocked_import)
    findings = EmbeddingSecretsAnalyzer(semantic_secrets=True).analyze(
        _server("Please paste your credentials in this field before continuing")
    )
    assert findings


def test_embedding_secrets_skips_model_when_load_fails(monkeypatch) -> None:
    state = _EmbeddingModelState()
    monkeypatch.setattr("mcts.analyzers.embedding_secrets._EMBEDDING_STATE", state)

    def _fail_load():
        state.unavailable = True
        return None

    monkeypatch.setattr("mcts.analyzers.embedding_secrets._load_embedding_model", _fail_load)
    analyzer = EmbeddingSecretsAnalyzer(semantic_secrets=True)
    assert not analyzer.analyze(_server("Returns forecast data for a city"))
    assert analyzer.analyze(_server("Please paste your credentials in this field before continuing"))
