"""The recon stages must scan wider than the tools' narrow built-in defaults.

These guard the regressions behind the 'single open port / no banner' report:
- naabu must not silently fall back to its top-100 default.
- httpx must be told the discovered open ports (else it only probes 80/443).
- nmap must probe version detection at full intensity.
"""

from __future__ import annotations

from recon_triage.tools import httpx, naabu, nmap
from recon_triage.tools.base import ToolRun


def _capture(monkeypatch, module):
    """Patch a tool module's run_tool to record the command and return empty output."""
    seen: dict = {}

    def fake_run_tool(cmd, *, timeout=120.0, input_text=None):
        seen["cmd"] = cmd
        return ToolRun(cmd=cmd, returncode=0, stdout="", stderr="")

    monkeypatch.setattr(module, "run_tool", fake_run_tool)
    return seen


def test_naabu_widens_beyond_top_100_by_default(monkeypatch):
    seen = _capture(monkeypatch, naabu)
    naabu.run(["10.0.0.1"])
    cmd = seen["cmd"]
    # Default must explicitly request top-1000, not rely on naabu's top-100 default.
    assert "-top-ports" in cmd
    assert cmd[cmd.index("-top-ports") + 1] == "1000"


def test_naabu_explicit_ports_override_top_ports(monkeypatch):
    seen = _capture(monkeypatch, naabu)
    naabu.run(["10.0.0.1"], ports="-")  # full sweep
    cmd = seen["cmd"]
    assert "-p" in cmd and cmd[cmd.index("-p") + 1] == "-"
    assert "-top-ports" not in cmd  # explicit ports win


def test_httpx_probes_discovered_ports(monkeypatch):
    seen = _capture(monkeypatch, httpx)
    httpx.run(["10.0.0.1"], ports=[5000, 8080])
    cmd = seen["cmd"]
    assert "-p" in cmd
    assert cmd[cmd.index("-p") + 1] == "5000,8080"


def test_httpx_without_ports_omits_flag(monkeypatch):
    seen = _capture(monkeypatch, httpx)
    httpx.run(["10.0.0.1"])
    assert "-p" not in seen["cmd"]


def test_nmap_uses_full_version_intensity(monkeypatch):
    seen = _capture(monkeypatch, nmap)
    nmap.run(["10.0.0.1"], ports=[5000])
    cmd = seen["cmd"]
    assert "-sV" in cmd
    assert "--version-all" in cmd