"""Version 1.0, 2026-09-09. Synthetic reference monitor, NOT OAuth or MCP.
Opaque fixture handles are deliberately non-secret. No JWT, signing, networking,
HTTP server, environment access, persistent storage, or provider integration.
"""
import unittest


class Broker:
    def __init__(self):
        self.grants = {}
        self.issued = 0
        self.calls = []

    def issue(self, subject="maya", tenant="amber", audience="https://docs.example/mcp", scopes=("docs:read",), expires=160):
        self.issued += 1
        handle = f"NOT-A-SECRET-fixture-{self.issued}"
        self.grants[handle] = dict(subject=subject, tenant=tenant, audience=audience,
                                   scopes=set(scopes), expires=expires, active=True)
        return handle

    def revoke(self, handle):
        self.grants[handle]["active"] = False

    def request(self, handle, now=100, tenant="amber", scope="docs:read"):
        grant = self.grants.get(handle)
        if (not grant or not grant["active"] or grant["expires"] <= now
                or grant["audience"] != "https://docs.example/mcp"):
            return {"status": 401, "error": "invalid_token"}
        if grant["tenant"] != tenant or scope not in grant["scopes"]:
            return {"status": 403, "error": "access_denied"}
        # Represents a downstream invocation after policy. Only the result is
        # model-facing; even this fixture handle stays in trusted transport code.
        self.calls.append({"subject": grant["subject"], "tenant": tenant, "scope": scope})
        return {"status": 200, "document_id": "DOC-001"}


class CredentialTests(unittest.TestCase):
    def setUp(self):
        self.broker = Broker()
        self.handle = self.broker.issue()

    def test_valid(self):
        self.assertEqual(self.broker.request(self.handle)["status"], 200)

    def test_revoked_denial_before_downstream(self):
        self.assertEqual(self.broker.request(self.handle)["status"], 200)
        self.broker.revoke(self.handle)
        self.assertEqual(self.broker.request(self.handle), {"status": 401, "error": "invalid_token"})
        self.assertEqual(len(self.broker.calls), 1)

    def test_rotation_invalidates_old_grant(self):
        replacement = self.broker.issue(expires=200)
        self.broker.revoke(self.handle)
        self.assertEqual(self.broker.request(self.handle)["status"], 401)
        self.assertEqual(self.broker.request(replacement)["status"], 200)

    def test_wrong_audience(self):
        other = self.broker.issue(audience="https://billing.example/api")
        self.assertEqual(self.broker.request(other)["status"], 401)
        self.assertEqual(self.broker.calls, [])

    def test_expired(self):
        self.assertEqual(self.broker.request(self.handle, now=160)["status"], 401)

    def test_wrong_tenant(self):
        self.assertEqual(self.broker.request(self.handle, tenant="birch")["status"], 403)

    def test_write_scope_denied(self):
        self.assertEqual(self.broker.request(self.handle, scope="docs:write")["status"], 403)

    def test_unknown_and_redacted(self):
        self.assertEqual(self.broker.request("unknown")["status"], 401)
        self.broker.revoke(self.handle)
        self.assertNotIn(self.handle, str(self.broker.request(self.handle)))
        self.assertNotIn(self.handle, str(self.broker.calls))


if __name__ == "__main__":
    unittest.main(verbosity=2)