"""Tests for VKP constants — address checksums, ABI completeness, security scan."""

import inspect

from web3 import Web3

from vkp.constants import (
    ACCOUNTABILITY_BONDS_ADDRESSES,
    CHAIN_IDS,
    DELEGATION_REGISTRY_ABI,
    EXPLORER_URLS,
    IDENTITY_REGISTRY_ADDRESSES,
    KEYVAULT_ABI,
    REPUTATION_REGISTRY_ADDRESSES,
    SESSION_KEY_MANAGER_ABI,
    SUPPORTED_NETWORKS,
    VKP_FACTORY_ABI,
)


def test_all_identity_addresses_are_valid_checksums():
    """Verify every identity registry address passes EIP-55 checksum."""
    for network_id, address in IDENTITY_REGISTRY_ADDRESSES.items():
        assert Web3.is_checksum_address(address), (
            f"Invalid checksum for identity registry on {network_id}: {address}"
        )


def test_all_bond_addresses_are_valid_checksums():
    """Verify every bond address passes EIP-55 checksum."""
    for network_id, address in ACCOUNTABILITY_BONDS_ADDRESSES.items():
        assert Web3.is_checksum_address(address), (
            f"Invalid checksum for bonds on {network_id}: {address}"
        )


def test_all_reputation_addresses_are_valid_checksums():
    """Verify every reputation registry address passes EIP-55 checksum."""
    for network_id, address in REPUTATION_REGISTRY_ADDRESSES.items():
        assert Web3.is_checksum_address(address), (
            f"Invalid checksum for reputation on {network_id}: {address}"
        )


def test_base_is_supported():
    """Verify Base (Coinbase L2) is a supported network."""
    assert "base-mainnet" in SUPPORTED_NETWORKS


def test_all_four_networks_supported():
    """Verify all four networks are listed."""
    expected = {"base-mainnet", "arbitrum-mainnet", "polygon-mainnet", "avalanche-mainnet"}
    assert expected.issubset(set(SUPPORTED_NETWORKS))


def test_chain_ids_correct():
    """Verify chain IDs are correct for each network."""
    assert CHAIN_IDS["base-mainnet"] == 8453
    assert CHAIN_IDS["arbitrum-mainnet"] == 42161
    assert CHAIN_IDS["polygon-mainnet"] == 137
    assert CHAIN_IDS["avalanche-mainnet"] == 43114


def test_explorer_urls_set():
    """Verify explorer URLs are set for all networks."""
    for network in SUPPORTED_NETWORKS:
        assert network in EXPLORER_URLS, f"Missing explorer URL for {network}"
        assert EXPLORER_URLS[network].startswith("https://"), (
            f"Explorer URL for {network} should be HTTPS"
        )


def test_keyvault_abi_has_execute():
    """Verify KeyVault ABI includes the execute function."""
    names = {entry["name"] for entry in KEYVAULT_ABI}
    assert "execute" in names
    assert "freeze" in names
    assert "emergencyWithdraw" in names


def test_session_abi_has_create():
    """Verify SessionKeyManager ABI includes createSession."""
    names = {entry["name"] for entry in SESSION_KEY_MANAGER_ABI}
    assert "createSession" in names
    assert "revokeSession" in names
    assert "isSessionValid" in names


def test_delegation_abi_has_create():
    """Verify DelegationRegistry ABI includes createDelegation."""
    names = {entry["name"] for entry in DELEGATION_REGISTRY_ABI}
    assert "createDelegation" in names
    assert "acceptDelegation" in names
    assert "revokeDelegation" in names
    assert "isDelegationValid" in names


def test_factory_abi_has_create_vault():
    """Verify VKPFactory ABI includes createVault."""
    names = {entry["name"] for entry in VKP_FACTORY_ABI}
    assert "createVault" in names
    assert "getAgentVaults" in names


def test_no_secrets_in_constants():
    """Security scan — ensure no private keys or tokens in constants."""
    import vkp.constants as mod
    source = inspect.getsource(mod)
    source_lower = source.lower()

    # These patterns should NEVER appear in constants
    forbidden_patterns = [
        "private_key",
        "secret",
        "mnemonic",
        "seed phrase",
    ]
    for pattern in forbidden_patterns:
        assert pattern not in source_lower, (
            f"SECURITY: Forbidden pattern '{pattern}' found in constants.py"
        )
