from __future__ import annotations

from fastapi import FastAPI
from fastapi.testclient import TestClient

from src.api.v1.agents import router


def test_github_target_private_backup_evidence_gate_endpoint_returns_read_only_gate():
    app = FastAPI()
    app.include_router(router, prefix="/api/v1")
    client = TestClient(app)

    response = client.get("/api/v1/agents/github-target-private-backup-evidence-gate")

    assert response.status_code == 200
    data = response.json()
    assert data["schema_version"] == "github_target_private_backup_evidence_gate_v1"
    assert data["mode"] == "read_only_private_backup_evidence_gate"
    assert data["summary"]["approval_required_target_count"] == 9
    assert data["summary"]["private_backup_verified_count"] == 0
    assert data["summary"]["blocked_target_count"] == 9
    assert data["summary"]["public_repo_allowed"] is False
    assert data["summary"]["repo_creation_authorized"] is False
    assert data["summary"]["visibility_change_authorized"] is False
    assert data["summary"]["refs_sync_authorized"] is False
    assert data["summary"]["secret_value_collection_allowed"] is False
    assert data["operation_boundaries"]["read_only_api_allowed"] is True
    assert data["operation_boundaries"]["github_api_write_allowed"] is False
    assert data["operation_boundaries"]["repo_creation_allowed"] is False
    assert data["operation_boundaries"]["visibility_change_allowed"] is False
    assert data["operation_boundaries"]["refs_sync_allowed"] is False
    assert data["operation_boundaries"]["workflow_trigger_allowed"] is False
    assert data["operation_boundaries"]["private_clone_url_collection_allowed"] is False
    assert "192.168.0." not in response.text
