//! End-to-end test for `mcptest run --header NAME=VALUE`.
//!
//! Confirms the CLI parses repeatable `--header` flags, attaches them to the
//! server-override banner, and rejects `Authorization` so the operator does
//! not bypass the `auth:` block by accident.

use assert_cmd::Command;
use predicates::prelude::*;
use tempfile::tempdir;

fn mcptest() -> Command {
    Command::cargo_bin("mcptest").expect("binary builds")
}

#[test]
fn run_accepts_repeatable_literal_header_flag() {
    let dir = tempdir().unwrap();
    mcptest()
        .current_dir(dir.path())
        .args([
            "--header",
            "X-Tenant=acme",
            "--header",
            "X-Trace-Id=abc-123",
            "run",
        ])
        .assert()
        .success()
        .stdout(predicate::str::contains(
            "Server-target override applied: --header",
        ))
        .stdout(predicate::str::contains("no config at"));
}

#[test]
fn run_rejects_authorization_in_header_flag() {
    let dir = tempdir().unwrap();
    mcptest()
        .current_dir(dir.path())
        .args(["--header", "Authorization=Bearer x", "run"])
        .assert()
        .failure()
        .stderr(predicate::str::contains("auth:"));
}

#[test]
fn run_rejects_header_flag_without_equals() {
    let dir = tempdir().unwrap();
    mcptest()
        .current_dir(dir.path())
        .args(["--header", "BADHEADER", "run"])
        .assert()
        .failure()
        .stderr(predicate::str::contains("NAME=VALUE"));
}
