use assay_mcp_server::auth::{AuthConfig, AuthMode, TokenValidator};
// We need to run server or simulate logic
use wiremock::matchers::{method, path};
use wiremock::{Mock, MockServer, ResponseTemplate};

#[tokio::test]
#[expect(clippy::field_reassign_with_default)]
async fn test_auth_rejection_e2e_simulation() {
    // We simulate the auth logic flow here to prove E6 behavior
    // 1. Setup JWKS mock
    let mock_server = MockServer::start().await;

    Mock::given(method("GET"))
        .and(path("/jwks.json"))
        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
            "keys": [] // Empty keys => validation always fails for RS256
        })))
        .mount(&mock_server)
        .await;

    // 2. Config Strict
    let mut config = AuthConfig::default();
    config.mode = AuthMode::Strict;
    config.jwks_uri = Some(mock_server.uri().parse().unwrap());
    config.jwks_uri.as_mut().unwrap().set_path("/jwks.json");

    let validator = TokenValidator::new(
        assay_mcp_server::auth::JwksProvider::new(config.jwks_uri.clone().unwrap()).ok(),
    );

    // 3. Test Invalid Token
    let token = "bad.token.struct";
    let res = validator.validate(token, &config).await;
    assert!(res.is_err());
    assert!(res.unwrap_err().to_string().contains("JWT header"));

    // 4. Test "None" Alg
    // (See unit tests for this, but this confirms E2E component integration)
}
