"""opax-mcp — MCP Streamable HTTP server for OPAX/Vauco
Transport: MCP Streamable HTTP (JSON-RPC 2.0) on POST /
Auth: Authorization: Bearer <secret>  OR  X-MCP-Secret: <secret>  OR  api-key: <secret>
"""
import os
import json
import uuid
import httpx
import base64
from urllib.parse import quote
import difflib
import google.auth
import google.auth.transport.requests
from google.cloud import kms_v1
import google.oauth2.id_token
from googleapiclient.discovery import build
from google.cloud import secretmanager
from google.oauth2 import service_account
from fastapi import FastAPI, Request, HTTPException, Form
from fastapi.responses import JSONResponse, StreamingResponse, HTMLResponse
from fastapi.middleware.cors import CORSMiddleware
import asyncio
import secrets

# --- OPAX Imports ---
from persistence.firestore_store import FirestoreMemoryStore
from persistence.memory_store import MemoryStore
from contracts.common import (
    CallerContext,
    CallEmmaRequest,
    CallEmmaResponse,
    AuditEvent as EmmaAuditEvent,
)
from policy.caller_context import derive_caller_context
from persistence.memory_scope import calculate_effective_memory_scope

# --- Tool Imports (with fault tolerance) ---
try:
    from tyr.tools.scan_tyr_surface import scan_tyr_surface
except Exception as e:
    print(f"Failed to load scan_tyr_surface: {e}")
    scan_tyr_surface = None
try:
    from tyr.tools.eval_tyr_identity import eval_tyr_identity
except Exception as e:
    print(f"Failed to load eval_tyr_identity: {e}")
    eval_tyr_identity = None
try:
    from tyr.tools.get_tyr_forecast import get_tyr_forecast
except Exception as e:
    print(f"Failed to load get_tyr_forecast: {e}")
    get_tyr_forecast = None
try:
    from tyr.tools.get_tyr_user_risk import get_tyr_user_risk
except Exception as e:
    print(f"Failed to load get_tyr_user_risk: {e}")
    get_tyr_user_risk = None
try:
    from modules.factory.tools.provision_new_mcp_module import provision_new_mcp_module
except Exception as e:
    print(f"Failed to load provision_new_mcp_module: {e}")
    provision_new_mcp_module = None
from emma_adapter import CanonicalEmma
from gitea_handler import (
    handle_list_repo_files,
    list_allowed_namespace_repositories,
    handle_get_file_content,
    resolve_branch_to_commit_sha,
    download_repo_archive,
    validate_repo_for_write,
    validate_branch_for_write,
    validate_path_for_write,
)
from capability_bridge import build_capability_system_context
from deployment_policy import get_deployment_target
from deployment_source import normalize_gitea_archive
from email.mime.text import MIMEText
from datetime import datetime, timezone, timedelta
from typing import Any, Optional, Dict, List, Literal
import logging
import re
from pydantic import BaseModel, Field
import hashlib

MAX_PROPOSE_CONTENT_BYTES = 1_048_576
_REPO_ID_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")

# A simple regex to validate the KMS key name format
_KMS_KEY_NAME_RE = re.compile(
    r"^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$"
)


# --- A2H2A Pydantic Models ---
class EncryptedPayloadV1(BaseModel):
    """Versioned Firestore-safe envelope for KMS-encrypted plan content."""

    payload_version: Literal["1"] = "1"
    kms_key_name: str
    ciphertext: str


GITEA_CHANGE_PLAN_STATUS_PENDING = "PENDING"
GITEA_CHANGE_PLAN_STATUS_APPROVED = "APPROVED"
GITEA_CHANGE_PLAN_STATUS_APPLYING = "APPLYING"
GITEA_CHANGE_PLAN_STATUS_APPLIED = "APPLIED"
GITEA_CHANGE_PLAN_STATUS_REJECTED = "REJECTED"
GITEA_CHANGE_PLAN_STATUS_EXPIRED = "EXPIRED"


class GiteaChangePlan(BaseModel):
    """Immutable admin-approved one-file Gitea change plan."""

    plan_id: str = Field(
        default_factory=lambda: f"gitea-change-{uuid.uuid4().hex}"
    )
    status: str = GITEA_CHANGE_PLAN_STATUS_PENDING

    created_at: datetime = Field(default_factory=datetime.utcnow)
    expires_at: datetime = Field(
        default_factory=lambda: datetime.utcnow() + timedelta(minutes=15)
    )
    approved_at: Optional[datetime] = None
    approved_by: Optional[str] = None
    applied_at: Optional[datetime] = None

    repo: str
    branch: str
    path: str
    base_sha: str
    content_hash: str
    commit_message: str
    unified_diff: str

    encrypted_payload: Optional[EncryptedPayloadV1] = None
    approval_subject_hash: Optional[str] = None

    result_commit_sha: Optional[str] = None
    existing_file_sha: Optional[str] = None
    apply_idempotency_key: Optional[str] = None
    apply_status: Optional[str] = None
    apply_error_message: Optional[str] = None


def is_gitea_change_plan_expired(plan: GiteaChangePlan) -> bool:
    """Checks if a Gitea change plan has expired."""
    now_utc = datetime.now(timezone.utc)
    expires_at = plan.expires_at

    if expires_at.tzinfo is None:
        expires_at = expires_at.replace(tzinfo=timezone.utc)

    return now_utc >= expires_at


_ALLOWED_GITEA_PLAN_TRANSITIONS = {
    GITEA_CHANGE_PLAN_STATUS_PENDING: {
        GITEA_CHANGE_PLAN_STATUS_APPROVED,
        GITEA_CHANGE_PLAN_STATUS_REJECTED,
        GITEA_CHANGE_PLAN_STATUS_EXPIRED,
    },
    GITEA_CHANGE_PLAN_STATUS_APPROVED: {
        GITEA_CHANGE_PLAN_STATUS_APPLYING,
        GITEA_CHANGE_PLAN_STATUS_EXPIRED,
    },
    GITEA_CHANGE_PLAN_STATUS_APPLYING: {GITEA_CHANGE_PLAN_STATUS_APPLIED},
}

def is_valid_gitea_change_plan_status_transition(
    current_status: str,
    next_status: str,
) -> bool:
    """Checks if a Gitea change plan status transition is allowed."""
    return next_status in _ALLOWED_GITEA_PLAN_TRANSITIONS.get(current_status, set())


async def create_gitea_change_plan(plan: GiteaChangePlan) -> dict:
    """Persist a pending one-file Gitea change plan in Firestore."""
    from google.cloud import firestore

    db = firestore.AsyncClient(project=GOOGLE_CLOUD_PROJECT)
    plan_data = plan.model_dump(mode="json")
    plan_data["status"] = "PENDING"

    plan_ref = db.collection("gitea_change_plans").document(plan.plan_id)
    await plan_ref.set(plan_data)

    logger.info(
        "Created Gitea change plan plan_id=%s repo=%s branch=%s path=%s",
        plan.plan_id,
        plan.repo,
        plan.branch,
        plan.path,
    )
    return plan_data


async def _encrypt_payload_v1(plaintext_content: str) -> EncryptedPayloadV1:
    """Encrypt plaintext UTF-8 content with the configured Cloud KMS key."""
    key_name = os.environ.get("GITEA_PLAN_KMS_KEY_NAME")
    if not key_name or not _KMS_KEY_NAME_RE.fullmatch(key_name):
        raise RuntimeError("KMS key is not configured or has an invalid format.")

    plaintext_bytes = plaintext_content.encode("utf-8")

    async with kms_v1.KeyManagementServiceAsyncClient() as client:
        response = await client.encrypt(
            request={"name": key_name, "plaintext": plaintext_bytes}
        )

    ciphertext = getattr(response, "ciphertext", None)
    if not isinstance(ciphertext, bytes) or not ciphertext:
        raise RuntimeError("KMS encryption returned an invalid empty ciphertext.")

    return EncryptedPayloadV1(
        kms_key_name=key_name,
        ciphertext=base64.b64encode(ciphertext).decode("ascii"),
    )


def _calculate_approval_subject_hash(plan: GiteaChangePlan) -> str:
    """Hash the immutable, approval-bound representation of a Gitea plan."""
    import binascii
    payload = plan.encrypted_payload
    if payload is None:
        raise ValueError(
            "Cannot calculate approval hash without an encrypted payload."
        )

    try:
        ciphertext_bytes = base64.b64decode(payload.ciphertext, validate=True)
    except (ValueError, TypeError, binascii.Error) as exc:
        raise ValueError("Encrypted payload ciphertext is invalid.") from exc

    subject = {
        "plan_id": plan.plan_id,
        "repo": plan.repo,
        "branch": plan.branch,
        "path": plan.path,
        "base_sha": plan.base_sha,
        "existing_file_sha": plan.existing_file_sha,
        "content_hash": plan.content_hash,
        "commit_message": plan.commit_message,
        "unified_diff": plan.unified_diff,
        "payload_version": payload.payload_version,
        "kms_key_name": payload.kms_key_name,
        "ciphertext_hash": hashlib.sha256(ciphertext_bytes).hexdigest(),
    }
    canonical_json = json.dumps(
        subject,
        sort_keys=True,
        separators=(",", ":"),
    ).encode("utf-8")
    return hashlib.sha256(canonical_json).hexdigest()


async def get_gitea_change_plan(
    plan_id: str,
) -> Optional[GiteaChangePlan]:
    """Return a persisted Gitea change plan, or None when it does not exist."""
    from google.cloud import firestore

    db = firestore.AsyncClient(project=GOOGLE_CLOUD_PROJECT)
    plan_ref = db.collection("gitea_change_plans").document(plan_id)
    document = await plan_ref.get()

    if not document.exists:
        return None

    return GiteaChangePlan(**document.to_dict())


async def transition_gitea_change_plan_status(
    plan_id: str,
    expected_status: str,
    next_status: str,
    updates: Optional[dict] = None,
) -> GiteaChangePlan:
    if not is_valid_gitea_change_plan_status_transition(expected_status, next_status):
        raise ValueError("Invalid Gitea change plan status transition")
    if updates and "status" in updates:
        raise ValueError("Gitea change plan updates cannot include status")

    from google.cloud import firestore

    db = firestore.AsyncClient(project=GOOGLE_CLOUD_PROJECT)
    plan_ref = db.collection("gitea_change_plans").document(plan_id)
    transaction = db.transaction()

    @firestore.async_transactional
    async def transactional_update(transaction):
        snapshot = await plan_ref.get(transaction=transaction)
        if not snapshot.exists:
            raise ValueError("Gitea change plan not found")
        if snapshot.get("status") != expected_status:
            raise ValueError("Gitea change plan status changed")

        update_data = dict(updates or {})
        update_data["status"] = next_status
        transaction.update(plan_ref, update_data)

    await transactional_update(transaction)
    updated_plan = await get_gitea_change_plan(plan_id)
    if updated_plan is None:
        raise ValueError("Gitea change plan not found")
    return updated_plan


def _validate_admin_gitea_path(path: str) -> None:
    """Validate a repository-relative admin file path."""
    if not isinstance(path, str) or not path or path.isspace():
        raise ValueError("Path cannot be empty.")
    if path.startswith("/") or "\\" in path or "\x00" in path:
        raise ValueError("Path contains unsupported characters.")
    segments = path.split("/")
    if any(segment in {".", ".."} for segment in segments):
        raise ValueError("Path traversal is not allowed.")

    lowered_path = path.lower()
    sensitive_markers = (
        ".env",
        ".pem",
        ".key",
        "credentials",
        "service_account",
        "private_key",
    )
    if any(marker in lowered_path for marker in sensitive_markers):
        raise ValueError("Path targets a sensitive file.")


def _validate_gitea_repo_format(repo: str) -> None:
    """Validate the canonical owner/repository identifier format."""
    if not isinstance(repo, str) or not _REPO_ID_RE.fullmatch(repo):
        raise ValueError("Repository must use the owner/repository format.")


async def _get_gitea_file_details(
    repo: str,
    path: str,
    ref: str,
) -> tuple[Optional[str], Optional[str]]:
    """Return decoded file content and file SHA; return (None, None) on 404."""
    api_path = f"/repos/{repo}/contents/{quote(path, safe='/')}?ref={ref}"

    try:
        payload = await _gitea_get(api_path)
    except httpx.HTTPStatusError as exc:
        if exc.response.status_code == 404:
            return None, None
        logger.warning(
            "Gitea file detail lookup failed repo=%s path=%s ref=%s status=%s",
            repo,
            path,
            ref,
            exc.response.status_code,
        )
        raise ValueError("Gitea API error while reading file details.") from exc

    try:
        encoded_content = payload["content"]
        content = base64.b64decode(encoded_content).decode("utf-8")
    except (KeyError, TypeError, ValueError, UnicodeDecodeError) as exc:
        raise ValueError("Gitea returned invalid file content.") from exc

    return content, payload.get("sha")


async def propose_gitea_change(p: dict) -> dict:
    """Create and persist a read-only, immutable one-file Gitea change plan."""
    repo = p.get("repo")
    branch = p.get("branch")
    path = p.get("path")
    new_content = p.get("new_content")
    base_sha = p.get("base_sha")
    commit_message = p.get("commit_message")

    if not all((repo, branch, path, base_sha, commit_message)):
        raise ValueError(
            "Missing required fields: repo, branch, path, base_sha, commit_message."
        )
    if new_content is None:
        raise ValueError("Missing required field: new_content.")
    if not isinstance(new_content, str):
        raise ValueError("new_content must be a string.")
    if len(new_content.encode("utf-8")) > MAX_PROPOSE_CONTENT_BYTES:
        raise ValueError("new_content exceeds the maximum allowed size.")

    _validate_gitea_repo_format(repo)
    if repo != GITEA_REPO:
        raise ValueError(
            "Repository change proposal is not allowed for this repository."
        )
    _validate_admin_gitea_path(path)

    validate_path_for_write(path)
    validate_branch_for_write(branch)

    live_sha = await resolve_branch_to_commit_sha(
        branch_name=branch,
        repo_id=repo,
        gitea_url=GITEA_URL,
    )
    if live_sha != base_sha:
        raise ValueError(
            "Branch head does not match the supplied base_sha. Refresh and retry."
        )

    old_content, existing_file_sha = await _get_gitea_file_details(
        repo=repo,
        path=path,
        ref=branch,
    )
    old_lines = (
        old_content.splitlines(keepends=True)
        if old_content is not None
        else []
    )
    new_lines = new_content.splitlines(keepends=True)
    unified_diff = "".join(
        difflib.unified_diff(
            old_lines,
            new_lines,
            fromfile=f"a/{path}",
            tofile=f"b/{path}",
        )
    )
    if not unified_diff:
        raise ValueError("Proposed content produces no file change.")

    content_hash = hashlib.sha256(new_content.encode("utf-8")).hexdigest()

    encrypted_payload = await _encrypt_payload_v1(new_content)

    plan = GiteaChangePlan(
        repo=repo,
        branch=branch,
        path=path,
        base_sha=base_sha,
        content_hash=content_hash,
        commit_message=commit_message,
        unified_diff=unified_diff,
        existing_file_sha=existing_file_sha,
        encrypted_payload=encrypted_payload,
    )
    plan.approval_subject_hash = _calculate_approval_subject_hash(plan)

    await create_gitea_change_plan(plan)

    return {
        "plan_id": plan.plan_id,
        "status": "PENDING",
        "expires_at": plan.expires_at.isoformat(),
        "unified_diff": unified_diff,
        "content_hash": content_hash,
        "approval_subject_hash": plan.approval_subject_hash,
        "repo": repo,
        "branch": branch,
        "path": path,
        "base_sha": base_sha,
        "commit_message": commit_message,
    }


class TicketSource(BaseModel):
    reporter: str
    trigger: str
    affected_service: str
    project_id: str
    region: str

class TicketContext(BaseModel):
    summary: str
    evidence_logs: List[str]

class ProposedAction(BaseModel):
    action_type: str
    runbook_reference: str
    execution_tool: str
    parameters: Dict
    parameter_hash: Optional[str] = None
    rollback_plan: str

class Governance(BaseModel):
    approval_status: str = "PENDING"
    authorized_approver: str
    requires_mfa: bool = True
    timeout_minutes: int = 15
    approval_token_hash: Optional[str] = None
    csrf_token_hash: Optional[str] = None
    approved_at: Optional[datetime] = None
    rejected_at: Optional[datetime] = None
    verified_approver_email: Optional[str] = None
    token_used_at: Optional[datetime] = None

class AuditEvent(BaseModel):
    event_id: str = Field(default_factory=lambda: str(uuid.uuid4()))
    ticket_id: str
    timestamp: datetime = Field(default_factory=datetime.utcnow)
    event_type: str  # e.g., PROPOSAL_CREATED, TICKET_APPROVED, TICKET_REJECTED
    actor: str
    details: Dict[str, Any]


class A2H2ATicket(BaseModel):
    ticket_id: str
    timestamp: datetime
    severity: str  # CRITICAL, HIGH, MEDIUM, LOW
    category: str
    source: TicketSource
    context: TicketContext
    proposed_action: ProposedAction
    governance: Governance

    def calculate_parameter_hash(self) -> str:
        """Beregn SHA-256 hash av parameters i kanonisk form."""
        param_json = json.dumps(self.proposed_action.parameters, sort_keys=True, separators=(",", ":"))
        return hashlib.sha256(param_json.encode()).hexdigest()

    def is_expired(self) -> bool:
        """Sjekk om ticket er utløpt"""
        from datetime import datetime, timedelta
        expiry = self.timestamp + timedelta(minutes=self.governance.timeout_minutes)
        return datetime.utcnow() > expiry.replace(tzinfo=None)

class ConfirmationRequired(BaseModel):
    message: str
    preview: dict
    requires_confirmation: bool = True

def require_confirmation(confirm: bool, preview: dict, message: str = "This action requires confirmation"):
    if not confirm:
        raise HTTPException(
            status_code=400,
            detail=ConfirmationRequired(message=message, preview=preview).model_dump()
        )


logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

app = FastAPI(title="opax-mcp", version="3.6.0") # BUMPED

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://opax-mcp-357036551735.us-central1.run.app"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

# --- Metrics ---
A2H2A_METRICS = {
    "tickets_created": 0,
    "tickets_approved": 0,
    "tickets_rejected": 0,
    "tickets_expired": 0,
}

@app.get("/metrics")
async def get_metrics():
    return A2H2A_METRICS

@app.get("/")
async def root_get():
    return {"status": "healthy", "service": "OPAX MCP Server", "version": "3.6.0"}

async def sse_event_stream(request: Request):
    """Yields server-sent events for MCP protocol."""
    # MCP requires an immediate connect event
    yield f"id: {uuid.uuid4()}\nevent: connect\ndata: {json.dumps({'protocolVersion': '2024-11-05'})}\n\n"
    while True:
        # Send keepalive pings every 15s
        yield f"id: {uuid.uuid4()}\nevent: ping\ndata: {json.dumps({'time': datetime.now(timezone.utc).isoformat()})}\n\n"
        await asyncio.sleep(15)

@app.get("/sse")
async def sse_endpoint(request: Request):
    """Handles Server-Sent Events for external clients like Perplexity."""
    return StreamingResponse(sse_event_stream(request), media_type="text/event-stream")

# --- A2H2A API Endpoints ---

# --- A2H2A Secure Design Placeholder ---
#
# The following logic is a placeholder for a secure A2H2A (Agent-to-Human-to-Agent)
# approval workflow. The key principles are:
#
# 1. NOTIFICATION, NOT ACTION: Google Chat messages are for notification only. They
#    do not carry any identity or authorization guarantee.
# 2. VERIFIED IDENTITY: Human approval must happen through a protected surface that
#    verifies the user's identity (e.g., a web app protected by Google IAP).
# 3. ATOMIC, IMMUTABLE ACTIONS: The ticket stored in the backend (Firestore) is the
#    source of truth. The proposed action, its parameters, and the server-generated
#    parameter hash are immutable.
# 4. ONE-TIME USE TOKENS: The approval UI should be accessed via a link containing a
#    cryptographically random, single-use token that is invalidated after the first
#    approval or rejection, or after the ticket's TTL expires.
# 5. DECOUPLED EXECUTION: The approval action only changes the ticket's state to
#    'APPROVED'. A separate, secure worker process will poll for approved tickets and
#    execute them, ensuring a clean separation of concerns. This worker validates the
#    ticket's integrity (non-expired, parameter hash match) before execution.
#
# This implementation only covers the safe recording of a proposed ticket.
# Execution is explicitly disabled.

# A strict allow-list of tools that can be proposed in an A2H2A ticket.
# `execution_enabled: False` means the tool can be proposed but not executed.
A2H2A_TOOL_ALLOW_LIST = {
    "example_tool_1": {"execution_enabled": False, "description": "A sample tool that does something harmless."},
    "example_tool_2": {"execution_enabled": False, "description": "Another sample tool."},
    # Add real, vetted tools here with execution_enabled: True ONLY after extensive security review.
}

async def _create_audit_event(db, event: AuditEvent):
    """Stores an audit event in Firestore."""
    event_ref = db.collection('a2h2a_audit_events').document(event.event_id)
    await event_ref.set(event.model_dump(mode='json'))
    logger.info(f"Created audit event {event.event_type} for ticket {event.ticket_id}")

@app.post("/api/v1/a2h2a/tickets")
async def create_a2h2a_ticket(ticket: A2H2ATicket, request: Request, test_mode: bool = False):
    """
    Opprett ny A2H2A ticket og send til Google Chat for godkjenning.
    Dette er kun en prototype for sikker registrering, ingen verktøy blir kjørt.
    """
    try:
        if not test_mode:
            await _verify_auth(request)

        # Security check: Reject if caller provides a parameter_hash.
        if ticket.proposed_action.parameter_hash is not None:
            raise HTTPException(status_code=400, detail="Do not provide a parameter_hash. The server will generate it.")

        # Security check: Ensure the proposed tool is in the allow-list.
        tool_name = ticket.proposed_action.execution_tool
        if tool_name not in A2H2A_TOOL_ALLOW_LIST:
            raise HTTPException(status_code=400, detail=f"Tool '{tool_name}' is not on the approved A2H2A allow-list.")

        # Generate parameter hash server-side for integrity.
        ticket.proposed_action.parameter_hash = ticket.calculate_parameter_hash()

        # Generate a cryptographically secure, single-use approval token.
        # The raw token is returned once in the review URL and never persisted.
        # Only its SHA-256 hash is stored server-side.
        raw_token = secrets.token_hex(32)
        token_hash = hashlib.sha256(raw_token.encode()).hexdigest()
        ticket.governance.approval_token_hash = token_hash

        from google.cloud import firestore
        db = firestore.AsyncClient(project=GOOGLE_CLOUD_PROJECT)

        ticket_data = ticket.model_dump(mode='json')
        ticket_data['created_at'] = datetime.utcnow().isoformat()
        ticket_data['governance']['approval_status'] = 'PENDING'

        doc_ref = db.collection('a2h2a_tickets').document(ticket.ticket_id)
        await doc_ref.set(ticket_data)

        # --- Create Initial Audit Event ---
        audit_event = AuditEvent(
            ticket_id=ticket.ticket_id,
            event_type="PROPOSAL_CREATED",
            actor="opax-mcp-server",  # Use a fixed, trusted server identity
            details={
                "severity": ticket.severity,
                "execution_tool": ticket.proposed_action.execution_tool,
                "parameter_hash": ticket.proposed_action.parameter_hash,
                "authorized_approver": ticket.governance.authorized_approver,
                "timeout_minutes": ticket.governance.timeout_minutes,
            }
        )
        await _create_audit_event(db, audit_event)


        # The approval URL now contains the raw token for one-time use.
        approval_ui_url = f"https://opax.vauco.no/a2h2a/review/{ticket.ticket_id}?token={raw_token}"

        google_chat_webhook = os.getenv('A2H2A_GOOGLE_CHAT_WEBHOOK')
        if google_chat_webhook and not test_mode:
            # The raw_token is NOT included in the chat payload, only in the approval_ui_url
            chat_payload = {
                "cards": [
                    {
                        "header": {
                            "title": f"🚨 A2H2A Proposal: {ticket.severity}",
                            "subtitle": "OSVxCC Security (Prototype - No Execution)",
                            "image": {"imageUrl": "https://www.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_92x30dp.png"}
                        },
                        "sections": [
                            {
                                "widgets": [
                                    {
                                        "textParagraph": {
                                            "text": f"<b>Category:</b> {ticket.category}<br>"                                                    f"<b>Service:</b> {ticket.source.affected_service}<br>"                                                    f"<b>Tool:</b> {ticket.proposed_action.execution_tool}<br>"                                                    f"<b>Summary:</b> {ticket.context.summary}"
                                        }
                                    },
                                    {
                                        "buttons": [
                                            {
                                                "textButton": {
                                                    "text": "REVIEW IN APPROVAL UI",
                                                    "onClick": {"openLink": {"url": approval_ui_url}}
                                                }
                                            }
                                        ]
                                    }
                                ]
                            }
                        ]
                    }
                ]
            }
            import httpx
            async with httpx.AsyncClient() as client:
                await client.post(google_chat_webhook, json=chat_payload)

        response_payload = {"status": "success", "ticket_id": ticket.ticket_id, "parameter_hash": ticket.proposed_action.parameter_hash}
        if test_mode:
            response_payload['raw_token'] = raw_token

        logger.info(f"A2H2A ticket created successfully: {ticket.ticket_id}", extra={"ticket_id": ticket.ticket_id, "event_type": "TICKET_CREATED"})
        A2H2A_METRICS["tickets_created"] += 1
        return response_payload
    except Exception as e:
        logger.error(f"Feil ved opprettelse av A2H2A ticket: {e}", extra={"ticket_id": ticket.ticket_id if 'ticket' in locals() else 'N/A', "event_type": "TICKET_CREATION_FAILED"}, exc_info=True)
        raise HTTPException(status_code=500, detail=str(e))

# --- A2H2A Approval UI (Prototype) ---
# These endpoints implement server-side validation of a single-use token
# and IAP-verified identity. They only change ticket state; no tool execution occurs.

@app.get("/a2h2a/review/{ticket_id}", response_class=HTMLResponse)
async def review_a2h2a_ticket(ticket_id: str, token: str, request: Request):
    """
    Displays a review page for an A2H2A ticket.
    This endpoint is expected to be protected by IAP.
    """
    from google.cloud import firestore
    db = firestore.AsyncClient(project=GOOGLE_CLOUD_PROJECT)
    ticket_ref = db.collection('a2h2a_tickets').document(ticket_id)
    ticket_doc = await ticket_ref.get()

    if not ticket_doc.exists:
        logger.warning("A2H2A review attempted for non-existent ticket.", extra={"ticket_id": ticket_id, "event_type": "REVIEW_TICKET_NOT_FOUND"})
        return HTMLResponse(content="<h1>404: Ticket not found</h1>", status_code=404)

    ticket = A2H2ATicket(**ticket_doc.to_dict())

    # --- Security Validation ---
    if ticket.governance.approval_status != 'PENDING':
        logger.warning(f"A2H2A review attempted for already actioned ticket {ticket_id}.", extra={"ticket_id": ticket_id, "status": ticket.governance.approval_status, "event_type": "REVIEW_TICKET_NOT_PENDING"})
        return HTMLResponse(content=f"<h1>400: Ticket Not Pending</h1><p>This ticket has already been actioned. Its current status is: <b>{ticket.governance.approval_status}</b>.</p>", status_code=400)
    if ticket.is_expired():
        logger.warning(f"A2H2A review attempted for expired ticket {ticket_id}.", extra={"ticket_id": ticket_id, "event_type": "REVIEW_TICKET_EXPIRED"})
        A2H2A_METRICS["tickets_expired"] += 1
        return HTMLResponse(content="<h1>400: Ticket Expired</h1>", status_code=400)

    provided_token_hash = hashlib.sha256(token.encode()).hexdigest()
    if not secrets.compare_digest(provided_token_hash, ticket.governance.approval_token_hash):
        logger.error(f"Invalid approval token for ticket {ticket_id}.", extra={"ticket_id": ticket_id, "event_type": "REVIEW_INVALID_TOKEN"})
        return HTMLResponse(content="<h1>403: Invalid Token</h1>", status_code=403)

    user_email = request.headers.get("X-Goog-Authenticated-User-Email", "").replace("accounts.google.com:", "")
    if not user_email or user_email != ticket.governance.authorized_approver:
        logger.error(f"Unauthorized approver for ticket {ticket_id}.", extra={"ticket_id": ticket_id, "user_email": user_email, "authorized_approver": ticket.governance.authorized_approver, "event_type": "REVIEW_UNAUTHORIZED_APPROVER"})
        return HTMLResponse(content=f"<h1>403: Unauthorized</h1><p>You (<b>{user_email}</b>) are not the authorized approver (<b>{ticket.governance.authorized_approver}</b>) for this ticket.</p>", status_code=403)

    expiry_time = ticket.timestamp + timedelta(minutes=ticket.governance.timeout_minutes)

    # --- Generate and store CSRF token ---
    csrf_token = secrets.token_hex(16)
    csrf_token_hash = hashlib.sha256(csrf_token.encode()).hexdigest()
    await ticket_ref.update({"governance.csrf_token_hash": csrf_token_hash})


    # --- Render HTML Page ---
    html_content = f"""
    <html>
        <head>
            <title>A2H2A Ticket Review</title>
            <style> body {{ font-family: sans-serif; }} </style>
        </head>
        <body>
            <h1>A2H2A Ticket Review: {ticket.severity}</h1>
            <p><b>Authorized Approver:</b> {ticket.governance.authorized_approver}</p>
            <p><b>Expires At:</b> {expiry_time.isoformat()}Z</p>
            <hr>
            <p><b>Ticket ID:</b> {ticket.ticket_id}</p>
            <p><b>Tool:</b> {ticket.proposed_action.execution_tool}</p>
            <p><b>Summary:</b> {ticket.context.summary}</p>
            <p><b>Parameters Hash:</b> {ticket.proposed_action.parameter_hash}</p>
            <hr>
            <form action="/a2h2a/approve" method="post" style="display: inline-block;">
                <input type="hidden" name="ticket_id" value="{ticket.ticket_id}">
                <input type="hidden" name="token" value="{token}">
                <input type="hidden" name="csrf_token" value="{csrf_token}">
                <button type="submit" style="background-color: #28a745; color: white; padding: 10px; border: none; border-radius: 5px; cursor: pointer;">Approve</button>
            </form>
            <form action="/a2h2a/reject" method="post" style="display: inline-block;">
                <input type="hidden" name="ticket_id" value="{ticket.ticket_id}">
                <input type="hidden" name="token" value="{token}">
                <input type="hidden" name="csrf_token" value="{csrf_token}">
                <button type="submit" style="background-color: #dc3545; color: white; padding: 10px; border: none; border-radius: 5px; cursor: pointer;">Reject</button>
            </form>
        </body>
    </html>
    """
    return HTMLResponse(content=html_content)

async def _process_approval_action(ticket_id: str, token: str, user_email: str, action: str, csrf_token: str):
    """Helper to handle the logic for approving or rejecting a ticket."""
    from google.cloud import firestore
    db = firestore.AsyncClient(project=GOOGLE_CLOUD_PROJECT)
    ticket_ref = db.collection('a2h2a_tickets').document(ticket_id)
    ticket_doc = await ticket_ref.get()

    if not ticket_doc.exists:
        raise HTTPException(status_code=404, detail="Ticket not found")

    ticket = A2H2ATicket(**ticket_doc.to_dict())
    ticket_dict = ticket_doc.to_dict()

    # --- Full Security Re-validation ---
    if ticket.governance.approval_status != 'PENDING':
        raise HTTPException(status_code=400, detail=f"Ticket has already been actioned (Status: {ticket.governance.approval_status})")
    if ticket.is_expired():
        A2H2A_METRICS["tickets_expired"] += 1
        raise HTTPException(status_code=400, detail="Ticket has expired")

    provided_token_hash = hashlib.sha256(token.encode()).hexdigest()
    if not secrets.compare_digest(provided_token_hash, ticket.governance.approval_token_hash):
        raise HTTPException(status_code=403, detail="Invalid token")

    # --- CSRF Token validation ---
    stored_csrf_hash = ticket_dict.get("governance", {}).get("csrf_token_hash")
    if not stored_csrf_hash:
        logger.error(f"CSRF token missing or already used for ticket {ticket_id}.", extra={"ticket_id": ticket_id, "user_email": user_email, "event_type": "APPROVAL_CSRF_TOKEN_MISSING"})
        raise HTTPException(status_code=403, detail="CSRF token missing or already used.")

    provided_csrf_hash = hashlib.sha256(csrf_token.encode()).hexdigest()
    if not secrets.compare_digest(provided_csrf_hash, stored_csrf_hash):
        logger.error(f"Invalid CSRF token for ticket {ticket_id}.", extra={"ticket_id": ticket_id, "user_email": user_email, "event_type": "APPROVAL_INVALID_CSRF_TOKEN"})
        raise HTTPException(status_code=403, detail="Invalid CSRF token")

    if user_email != ticket.governance.authorized_approver:
        logger.error(f"Unauthorized approver in approval action for ticket {ticket_id}.", extra={"ticket_id": ticket_id, "user_email": user_email, "authorized_approver": ticket.governance.authorized_approver, "event_type": "APPROVAL_UNAUTHORIZED_APPROVER"})
        raise HTTPException(status_code=403, detail="Unauthorized")

    now = datetime.utcnow()
    update_data = {
        "governance.approval_status": action,
        "governance.verified_approver_email": user_email,
        "governance.token_used_at": now.isoformat(),
        f"governance.{action.lower()}_at": now.isoformat(),
        "governance.csrf_token_hash": None  # Invalidate CSRF token
    }

    await ticket_ref.update(update_data)
    logger.info(f"A2H2A ticket {ticket_id} has been {action.lower()}.")
    if action == "APPROVED":
        A2H2A_METRICS["tickets_approved"] += 1
    elif action == "REJECTED":
        A2H2A_METRICS["tickets_rejected"] += 1

    audit_event = AuditEvent(
        ticket_id=ticket.ticket_id,
        event_type=f"TICKET_{action}",
        actor=user_email,
        details={"message": f"Ticket was {action.lower()} by {user_email}."}
    )
    await _create_audit_event(db, audit_event)

    return {"status": action.lower(), "ticket_id": ticket_id}

@app.post("/a2h2a/approve")
async def approve_a2h2a_ticket(request: Request, ticket_id: str = Form(...), token: str = Form(...), csrf_token: str = Form(...)):
    user_email = request.headers.get("X-Goog-Authenticated-User-Email", "").replace("accounts.google.com:", "")
    if not user_email: raise HTTPException(status_code=403, detail="IAP header missing or invalid.")
    return await _process_approval_action(ticket_id, token, user_email, "APPROVED", csrf_token)

@app.post("/a2h2a/reject")
async def reject_a2h2a_ticket(request: Request, ticket_id: str = Form(...), token: str = Form(...), csrf_token: str = Form(...)):
    user_email = request.headers.get("X-Goog-Authenticated-User-Email", "").replace("accounts.google.com:", "")
    if not user_email: raise HTTPException(status_code=403, detail="IAP header missing or invalid.")
    return await _process_approval_action(ticket_id, token, user_email, "REJECTED", csrf_token)





# ── Service discovery ───────────────────────────────────────────────────────
OSVAUCO_AGENT_URL    = os.environ.get("OSVAUCO_AGENT_URL", "") # f.eks. https://osvauco-agent-....run.app
MCP_SECRET           = os.environ.get("MCP_SECRET", "")
INTERNAL_API_KEY     = os.environ.get("INTERNAL_API_KEY", "")
GITEA_URL            = os.environ.get("GITEA_URL", "http://34.59.131.162:3000")
GITEA_TOKEN          = os.environ.get("GITEA_TOKEN", "")
GITEA_REPO           = os.environ.get("GITEA_REPO", "chris/OSVauco")
GOOGLE_CLOUD_PROJECT = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5")
WORKSPACE_ADMIN_USER = "chris.christiansen@vauco.no"

# Emma-vm Ollama — direkte tilkobling
OLLAMA_BASE_URL      = os.environ.get("OLLAMA_BASE_URL", "http://34.13.238.133:11434")
EMMA_MODEL           = os.environ.get("EMMA_MODEL", "gemma3:27b")
EMMA_FAST_MODEL      = os.environ.get("EMMA_FAST_MODEL", "gemma3:4b")
EMMA_LIGHT_MODEL     = os.environ.get("EMMA_LIGHT_MODEL", "qwen2.5:3b")

logger.info(f"OSVAUCO_AGENT_URL: {OSVAUCO_AGENT_URL}")
logger.info(f"OLLAMA_BASE_URL: {OLLAMA_BASE_URL}")


# ---------------------------------------------------------------------------
# Auth (kun for innkommende kall til opax-mcp, f.eks. fra Gemini TUI)
# ---------------------------------------------------------------------------

async def _verify_auth(request: Request) -> None:
    secret = os.getenv("MCP_SECRET")
    if not secret:
        logger.error("MCP_SECRET is not configured on the server.")
        raise HTTPException(status_code=500, detail="MCP_SECRET not configured")

    # Perplexity sends 'api-key', others might send 'X-MCP-Secret' or 'Authorization: Bearer ...'
    token = request.headers.get("api-key")
    if not token:
        token = request.headers.get("X-MCP-Secret")
    if not token:
        auth_header = request.headers.get("Authorization", "")
        if auth_header.startswith("Bearer "):
            token = auth_header[7:]

    if not token or not secrets.compare_digest(token.encode(), secret.encode()):
        raise HTTPException(status_code=401, detail="Invalid or missing API key")


# ---------------------------------------------------------------------------
# Backend Agent helpers (for kall VIDERE til osvauco-agent)
# ---------------------------------------------------------------------------

def _get_identity_token(audience: str) -> str:
    """Fetches a Google-signed identity token for the given audience."""
    # OPAX_LOCAL_DEV_MODE bypass is for local testing where metadata server is not available.
    if os.environ.get("OPAX_LOCAL_DEV_MODE") == "true":
        logger.warning("OPAX_LOCAL_DEV_MODE is enabled, skipping identity token fetch.")
        return ""

    try:
        auth_req = google.auth.transport.requests.Request()
        token = google.oauth2.id_token.fetch_id_token(auth_req, audience)
        return token
    except Exception as e:
        logger.error(f"Failed to fetch identity token for audience {audience}: {e}", exc_info=True)
        raise RuntimeError(f"Could not obtain identity token for service-to-service authentication.") from e

async def _agent_headers() -> dict:
    """Headers for machine-to-machine calls to osvauco-agent."""
    token = await asyncio.to_thread(_get_identity_token, OSVAUCO_AGENT_URL)

    headers = {
        "X-Internal-Key": INTERNAL_API_KEY,
        "Content-Type": "application/json",
    }

    if token:
        headers["Authorization"] = f"Bearer {token}"

    return headers

async def _agent_get(path: str) -> Any:
    """GET-kall til osvauco-agent."""
    url = f"{OSVAUCO_AGENT_URL}{path}"
    async with httpx.AsyncClient(timeout=30) as c:
        # Headers are now generated asynchronously for each request.
        request_headers = await _agent_headers()
        r = await c.get(url, headers=request_headers)
        r.raise_for_status()
        return r.json()

async def _agent_post(path: str, body: dict) -> Any:
    """POST-kall til osvauco-agent."""
    url = f"{OSVAUCO_AGENT_URL}{path}"
    async with httpx.AsyncClient(timeout=45) as c:
        # Headers are now generated asynchronously for each request.
        request_headers = await _agent_headers()
        r = await c.post(url, json=body, headers=request_headers)
        r.raise_for_status()
        return r.json()

# ---------------------------------------------------------------------------
# Google Workspace Helpers
# ---------------------------------------------------------------------------

def _get_workspace_service(api: str, version: str, scopes: list):
    """
    Creates an authenticated Google API service object using a service account
    key from Secret Manager and impersonating the admin user.
    """
    try:
        client = secretmanager.SecretManagerServiceClient()
        secret_name = "workspace-sa-key"
        version_name = f"projects/{GOOGLE_CLOUD_PROJECT}/secrets/{secret_name}/versions/latest"
        response = client.access_secret_version(request={"name": version_name})
        secret_payload = response.payload.data.decode("UTF-8")
        secret_info = json.loads(secret_payload)
        creds = service_account.Credentials.from_service_account_info(
            secret_info, scopes=scopes
        )
        delegated_creds = creds.with_subject(WORKSPACE_ADMIN_USER)
        return build(api, version, credentials=delegated_creds, cache_discovery=False)
    except Exception as e:
        logger.error(f"Failed to get Workspace service: {e}", exc_info=True)
        raise

async def create_email_alias(p: dict) -> dict:
    """Creates a new email alias for a Google Workspace user."""
    user_key = p.get("user_key")
    alias_email = p.get("alias")
    if not user_key or not alias_email:
        raise ValueError("Missing required parameters: 'user_key' and 'alias'")
    service = _get_workspace_service('admin', 'directory_v1', ['https://www.googleapis.com/auth/admin.directory.user'])
    alias_body = {'alias': alias_email}
    logger.info(f"Creating alias '{alias_email}' for user '{user_key}'...")
    result = service.users().aliases().insert(userKey=user_key, body=alias_body).execute()
    logger.info(f"Successfully created alias.")
    return {"status": "success", "alias": result}

async def list_user_aliases(p: dict) -> dict:
    """Lists all aliases for a Google Workspace user."""
    user_key = p.get("user_key")
    if not user_key:
        raise ValueError("Missing required parameter: 'user_key'")
    service = _get_workspace_service('admin', 'directory_v1', ['https://www.googleapis.com/auth/admin.directory.user'])
    logger.info(f"Listing aliases for user '{user_key}'...")
    result = service.users().aliases().list(userKey=user_key).execute()
    logger.info(f"Successfully listed aliases.")
    return {"status": "success", "aliases": result.get("aliases", [])}

async def delete_email_alias(p: dict) -> dict:
    """Deletes an email alias from a Google Workspace user."""
    user_key = p.get("user_key")
    alias_email = p.get("alias")
    if not user_key or not alias_email:
        raise ValueError("Missing required parameters: 'user_key' and 'alias'")
    service = _get_workspace_service('admin', 'directory_v1', ['https://www.googleapis.com/auth/admin.directory.user'])
    logger.info(f"Deleting alias '{alias_email}' for user '{user_key}'...")
    service.users().aliases().delete(userKey=user_key, alias=alias_email).execute()
    logger.info(f"Successfully deleted alias.")
    return {"status": "success", "detail": f"Alias '{alias_email}' deleted."}

async def send_email_as(p: dict) -> dict:
    """Sends an email as a user or their alias, on their behalf."""
    from_address, to_address, subject, body = p.get("from"), p.get("to"), p.get("subject"), p.get("body")
    if not all([from_address, to_address, subject, body]):
        raise ValueError("Missing required parameters: 'from', 'to', 'subject', 'body'")
    service = _get_workspace_service('gmail', 'v1', ['https://www.googleapis.com/auth/gmail.send'])
    message = MIMEText(body)
    message['to'], message['from'], message['subject'] = to_address, from_address, subject
    encoded_message = base64.urlsafe_b64encode(message.as_bytes()).decode()
    create_message = {'raw': encoded_message}
    logger.info(f"Sending email from '{from_address}' to '{to_address}'...")
    send_message = service.users().messages().send(userId='me', body=create_message).execute()
    logger.info(f"Successfully sent email with ID: {send_message['id']}")
    return {"status": "success", "message_id": send_message['id']}

async def get_workspace_user(p: dict) -> dict:
    """Gets detailed information about a single user in Google Workspace."""
    user_key = p.get("user_key")
    if not user_key: raise ValueError("Missing required parameter: 'user_key'")
    service = _get_workspace_service('admin', 'directory_v1', ['https://www.googleapis.com/auth/admin.directory.user'])
    logger.info(f"Getting info for user '{user_key}'...")
    user = service.users().get(userKey=user_key).execute()
    logger.info(f"Successfully retrieved user info.")
    return {"name": user.get("name", {}).get("fullName"), "email": user.get("primaryEmail"), "aliases": user.get("aliases", []), "suspended": user.get("suspended"), "lastLoginTime": user.get("lastLoginTime")}

async def list_workspace_users(p: dict) -> dict:
    """Lists all users in the Google Workspace domain."""
    service = _get_workspace_service('admin', 'directory_v1', ['https://www.googleapis.com/auth/admin.directory.user'])
    logger.info("Listing all workspace users...")
    result = service.users().list(domain='vauco.no', maxResults=50, orderBy='email').execute()
    users = result.get('users', [])
    logger.info(f"Found {len(users)} users.")
    return {"users": [{"email": user.get("primaryEmail"), "name": user.get("name", {}).get("fullName")} for user in users]}

async def get_emails(p: dict) -> dict:
    """Searches a user's mailbox and retrieves a list of emails."""
    user_key, query, max_results = p.get('user_key'), p.get('query', ''), p.get('max_results', 10)
    if not user_key: raise ValueError("Missing required parameter: 'user_key'")
    service = _get_workspace_service('gmail', 'v1', ['https://www.googleapis.com/auth/gmail.modify'])
    logger.info(f"Searching emails for user '{user_key}' with query '{query}'...")
    list_result = service.users().messages().list(userId=user_key, q=query, maxResults=max_results).execute()
    messages = list_result.get('messages', [])
    if not messages: return {"messages": []}
    email_details = []
    for msg in messages:
        detail = service.users().messages().get(userId=user_key, id=msg['id'], format='metadata', metadataHeaders=['subject', 'from']).execute()
        headers = {h['name']: h['value'] for h in detail['payload']['headers']}
        email_details.append({"id": msg['id'], "snippet": detail.get('snippet'), "subject": headers.get('Subject'), "from": headers.get('From')})
    logger.info(f"Successfully retrieved {len(email_details)} emails.")
    return {"messages": email_details}

async def list_calendar_events(p: dict) -> dict:
    """Lists events from a user's calendar."""
    user_key, days_ahead = p.get('user_key'), p.get('days_ahead', 7)
    if not user_key: raise ValueError("Missing required parameter: 'user_key'")
    service = _get_workspace_service('calendar', 'v3', ['https://www.googleapis.com/auth/calendar'])
    logger.info(f"Fetching calendar events for '{user_key}' for the next {days_ahead} days...")
    now, time_min = datetime.now(timezone.utc), (datetime.now(timezone.utc)).isoformat()
    time_max = (now + timedelta(days=days_ahead)).isoformat()
    events_result = service.events().list(calendarId=user_key, timeMin=time_min, timeMax=time_max, singleEvents=True, orderBy='startTime').execute()
    events = events_result.get('items', [])
    formatted_events = [{"summary": event.get('summary'), "start": event.get('start', {}).get('dateTime', event.get('start', {}).get('date')), "end": event.get('end', {}).get('dateTime', event.get('end', {}).get('date')), "organizer": event.get('organizer', {}).get('email')} for event in events]
    logger.info(f"Found {len(formatted_events)} events.")
    return {"events": formatted_events}

async def trigger_build(p: dict) -> dict:
    """Triggers a Cloud Build manually by its trigger ID."""
    from google.cloud.devtools import cloudbuild_v1

    project_id = GOOGLE_CLOUD_PROJECT
    trigger_id = p.get("trigger_id")
    branch = p.get("branch", "main")
    substitutions = p.get("substitutions", {})

    if not trigger_id:
        raise ValueError("Missing required parameter: 'trigger_id'")

    try:
        client = cloudbuild_v1.CloudBuildClient()
        source = cloudbuild_v1.RepoSource(branch_name=branch, substitutions=substitutions)

        response = client.run_build_trigger(
            project_id=project_id,
            trigger_id=trigger_id,
            source=source,
        )

        build_id = response.metadata.build.id
        logger.info(f"Successfully triggered Cloud Build. Build ID: {build_id}")
        return {"status": "success", "build_id": build_id}
    except Exception as e:
        logger.error(f"Failed to trigger Cloud Build: {e}", exc_info=True)
        raise HTTPException(status_code=500, detail=f"Failed to trigger Cloud Build: {e}")

# ---------------------------------------------------------------------------
# Ollama helpers — direkte mot emma-gpu-vm
# ---------------------------------------------------------------------------

async def _ollama_chat(model: str, prompt: str, system: str = "", history: Optional[List[Dict[str, str]]] = None) -> dict:
    # ... (beholdt uendret)
    messages = []
    if system:
        messages.append({"role": "system", "content": system})
    if history:
        messages.extend(history)
    messages.append({"role": "user", "content": prompt})
    payload = {
        "model": model,
        "messages": messages,
        "stream": False
    }
    try:
        async with httpx.AsyncClient(timeout=120) as c:
            r = await c.post(f"{OLLAMA_BASE_URL}/api/chat", json=payload)
            r.raise_for_status()
            data = r.json()
            return { "model": model, "response": data.get("message", {}).get("content", ""), "done": data.get("done", True), "total_duration_ms": round(data.get("total_duration", 0) / 1e6) }
    except Exception as e:
        logger.error(f"[OLLAMA ERROR] model={model} {type(e).__name__}: {e}")
        raise

canonical_emma = CanonicalEmma(
    chat_function=_ollama_chat,
    model="gemma3:4b"
)

async def _ollama_models() -> list:
    async with httpx.AsyncClient(timeout=10) as c:
        r = await c.get(f"{OLLAMA_BASE_URL}/api/tags")
        r.raise_for_status()
        return r.json().get("models", [])

# ---------------------------------------------------------------------------
# Gitea helpers
# ---------------------------------------------------------------------------

def _gitea_headers() -> dict:
    return {"Authorization": f"token {GITEA_TOKEN}", "Content-Type": "application/json", "Accept": "application/json"}

async def _gitea_get(path: str) -> Any:
    # ... (beholdt uendret)
    async with httpx.AsyncClient(timeout=30) as c:
        r = await c.get(f"{GITEA_URL}/api/v1{path}", headers=_gitea_headers())
        r.raise_for_status()
        return r.json()

async def _gitea_post(path: str, body: dict) -> Any:
    # ... (beholdt uendret)
    async with httpx.AsyncClient(timeout=30) as c:
        r = await c.post(f"{GITEA_URL}/api/v1{path}", json=body, headers=_gitea_headers())
        r.raise_for_status()
        return r.json()

async def _gitea_put(path: str, body: dict) -> Any:
    # ... (beholdt uendret)
    async with httpx.AsyncClient(timeout=30) as c:
        r = await c.put(f"{GITEA_URL}/api/v1{path}", json=body, headers=_gitea_headers())
        r.raise_for_status()
        return r.json()


# ---------------------------------------------------------------------------
# Phase 2C: Local-only, identity-gated helpers for call_emma
# ---------------------------------------------------------------------------

def is_call_emma_local_mode_enabled() -> bool:
    """Checks if the server is configured to run call_emma in local test mode."""
    return (
        os.getenv("ENABLE_CALL_EMMA_TOOL", "").lower() == "true"
        and bool(os.getenv("FIRESTORE_EMULATOR_HOST"))
    )

def get_emma_store() -> MemoryStore:
    """Factory to get the appropriate memory store for call_emma."""
    if not is_call_emma_local_mode_enabled():
        raise RuntimeError(
            "call_emma is enabled only for local Firestore emulator mode."
        )

    project_id = os.getenv("GOOGLE_CLOUD_PROJECT", "opax-phase2c-local")
    return FirestoreMemoryStore(project_id=project_id)

def get_call_emma_caller_context() -> CallerContext:
    """
    Gets the caller context for call_emma, using a server-injected test identity.
    This is for local/test environments only.
    """
    if not is_call_emma_local_mode_enabled():
        raise RuntimeError(
            "Test caller context is available only in local emulator mode."
        )

    test_caller_id = os.getenv("OPAX_EMMA_TEST_CALLER_ID")
    if not test_caller_id:
        raise ValueError(
            "Configuration error: OPAX_EMMA_TEST_CALLER_ID must be set "
            "for local emulator tests."
        )

    return derive_caller_context(test_caller_id)


async def _local_deterministic_emma_chat(model: str, prompt: str, system: str = "") -> dict:
    """A local, deterministic, non-network chat function for testing."""
    return {
        "model": "local-test-model",
        "response": "This is a deterministic local reply.",
        "done": True,
        "total_duration_ms": 1,
    }


# ---------------------------------------------------------------------------
# Tool implementations (refaktorert til å bruke _agent_get/_agent_post)
# ---------------------------------------------------------------------------

async def get_billing_summary(p):          return await _agent_get("/billing/summary")
async def get_billing_forecast(p):         return await _agent_get("/billing/forecast")
async def get_billing_credits(p):          return await _agent_get("/billing/credits")
async def get_billing_anomalies(p):        return await _agent_get("/billing/anomalies")
async def get_billing_history(p):          return await _agent_get("/billing/history")
async def get_billing_budget(p):           return await _agent_get("/billing/budget")
async def get_billing_tokens_by_module(p): return await _agent_get("/telemetry/history")
async def set_billing_budget(p):           return await _agent_post("/billing/budget", {"budget": p.get("amount", 500)})

async def create_invite(p):
    return await _agent_post("/onboard/invite", {
        "company": p.get("company", p.get("name", "")), "email": p.get("email"), "tier": p.get("tier", "starter"),
    })

async def list_customers(p):               return await _agent_get("/state")
async def send_webhook(p):
    return await _agent_post("/notify/webhook", {
        "url": p.get("url", ""), "event": p.get("event", "custom"),
        "title": p.get("title", "OPAX varsel"), "body": p.get("message", p.get("body", "")),
    })

async def send_email(p):                   return await _agent_post("/notify/email", {"to": p.get("to"), "subject": p.get("subject"), "event": p.get("event", "digest")})
async def send_sms(p):                     return await _agent_post("/notify/sms", {"to": p.get("to"), "body": p.get("message", p.get("body", "")), "event": p.get("event", "spike"), "tier": p.get("tier", "guard")})
async def get_notify_channels(p):          return await _agent_get("/notify/channels")
async def get_health(p):                   return await _agent_get("/health")
async def get_build_status(p):             return await _agent_get("/opax/build-status")
async def get_state(p):                    return await _agent_get("/state")
async def get_telemetry(p):                return await _agent_get("/telemetry/history")
async def run_terminal(p):                 return await _agent_post("/terminal/exec", {"cmd": p.get("command", p.get("cmd", "help"))})
async def tui_command(p):                  return await _agent_post("/tui-command", p)

# --- Uendrede funksjoner ---
async def run_jason(p):
    """Kaller /run på osvauco-agent, som nå har sin egen JASON_BACKEND-logikk."""
    return await _agent_post("/run", {"message": p.get("prompt", p.get("message", "")), "user_id": p.get("user_id", "opax"), "session_id": p.get("session_id", "mcp"), "mode": p.get("mode", "light")})
def _normalize_emma_history(value):
    if not isinstance(value, list):
        return []

    normalized = []
    for entry in value:
        if not isinstance(entry, dict):
            continue

        role = entry.get("role")
        content = entry.get("content")

        if role not in {"user", "assistant"}:
            continue

        if not isinstance(content, str):
            continue

        content = content.strip()
        if not content:
            continue

        normalized.append({"role": role, "content": content})

    return normalized[-40:]

async def run_emma(p: dict) -> dict:
    """Kaller den kanoniske Emma-agenten med en prompt."""
    capability_system_context = build_capability_system_context()
    return await canonical_emma.run(
        prompt=p.get("prompt", p.get("message", "")),
        history=_normalize_emma_history(p.get("history")),
        system_context=capability_system_context,
    )
async def run_emma_fast(p):                return await _ollama_chat(EMMA_FAST_MODEL, p.get("prompt", p.get("message", "")), p.get("system", "Du er en rask og konsis AI-assistent..."))
async def run_qwen(p):                     return await _ollama_chat(EMMA_LIGHT_MODEL, p.get("prompt", p.get("message", "")))
async def list_emma_models(p):             return await _ollama_models()
async def list_gitea_repositories(p: dict) -> dict:
    """Wrapper for the read-only, metadata-only repository catalog."""
    if p:
        raise ValueError("list_gitea_repositories does not accept any arguments.")
    return await list_allowed_namespace_repositories()

async def list_commits(p):                 return await _gitea_get(f"/repos/{p.get('repo', GITEA_REPO)}/commits?limit={p.get('limit', 10)}")

async def get_file(p: dict) -> dict:
    """Wrapper for the hardened get_file_content handler."""
    # Note: server_repo_id (GITEA_REPO) is validated inside the handler now.
    return await handle_get_file_content(p, GITEA_REPO)
async def list_open_issues(p):             return await _gitea_get(f"/repos/{p.get('repo', GITEA_REPO)}/issues?state=open&limit=20")

async def list_repo_files(p: dict) -> dict:
    """Wrapper for handle_list_repo_files that enforces server-side constraints."""
    if set(p.keys()) - {"path"}:
        raise ValueError("Unsupported list_repo_files input field.")
    return await handle_list_repo_files({"path": p.get("path")}, GITEA_REPO)
async def create_issue(p):                 return await _gitea_post(f"/repos/{p.get('repo', GITEA_REPO)}/issues", {"title": p.get("title"), "body": p.get("body", "")})
async def push_file(p):
    # ... (beholdt uendret)
    repo, path = p.get("repo", GITEA_REPO), p.get("path")
    content = base64.b64encode(p.get("content", "").encode()).decode()
    body = {"message": p.get("message", f"chore: update {path} via opax-mcp"), "content": content, "branch": p.get("branch", "main")}
    if not p.get("sha"):
        try:
            existing = await _gitea_get(f"/repos/{repo}/contents/{path}?ref={p.get('branch','main')}")
            body["sha"] = existing["sha"]
        except Exception: pass
    else: body["sha"] = p["sha"]
    if "sha" in body: return await _gitea_put(f"/repos/{repo}/contents/{path}", body)
    return await _gitea_post(f"/repos/{repo}/contents/{path}", body)


_SHA_RE = re.compile(r"^[0-9a-f]{40}$")

async def fetch_and_normalize_source(p: dict) -> dict:
    """
    Resolves a service and Git ref, fetches the source archive, normalizes it,
    and returns deterministic build metadata.
    """
    service_key = p.get("service_key")
    ref = p.get("ref")

    if not isinstance(service_key, str) or not service_key:
        raise ValueError("Missing or invalid 'service_key'")
    if not isinstance(ref, str) or not ref:
        raise ValueError("Missing or invalid 'ref'")

    target_policy = get_deployment_target(service_key)
    repo_id = target_policy["repository"]
    required_paths = target_policy["required_source_paths"]

    requested_ref_lower = ref.lower()
    if _SHA_RE.fullmatch(requested_ref_lower):
        resolved_commit_sha = requested_ref_lower
    else:
        resolved_commit_sha = await resolve_branch_to_commit_sha(
            branch_name=ref,
            repo_id=repo_id,
            gitea_url=GITEA_URL,
        )

    archive_bytes = await download_repo_archive(
        commit_sha=resolved_commit_sha,
        repo_id=repo_id,
        gitea_url=GITEA_URL,
    )

    _normalized_bytes, manifest = normalize_gitea_archive(
        archive_bytes=archive_bytes,
        required_paths=required_paths,
    )

    return {
        "service_key": service_key,
        "repository": repo_id,
        "requested_ref": ref,
        "resolved_commit_sha": resolved_commit_sha,
        "sha256": manifest["sha256"],
        "source_bytes": manifest["source_bytes"],
        "wrapper_directory_stripped": manifest["wrapper_directory_stripped"],
    }

# ---------------------------------------------------------------------------
# Memory Bank & Deployment Tools
# ---------------------------------------------------------------------------
PROJECT_DIR = os.path.abspath("project")
PROD_BUILD_TRIGGER_ID = "cf42cbc7-a5e8-4724-a569-dbaac1b46a0b"

def _resolve_memory_path(file_name: str) -> str:
    """Resolves a file path and ensures it is within the project/ directory."""
    if not file_name or '..' in file_name or file_name.startswith('/'):
        raise ValueError("Invalid file name.")

    abs_path = os.path.abspath(os.path.join(PROJECT_DIR, file_name))

    if not abs_path.startswith(PROJECT_DIR):
        raise ValueError("Security violation: Path is outside the allowed memory bank directory.")

    return abs_path

async def read_memory_bank(p: dict) -> dict:
    """Reads content from a file in the memory bank (project/ directory)."""
    file_name = p.get("file_name")
    if not file_name:
        raise ValueError("Missing required parameter: 'file_name'")

    file_path = _resolve_memory_path(file_name)

    try:
        with open(file_path, 'r', encoding='utf-8') as f:
            content = f.read()
        return {"file_path": file_name, "content": content}
    except FileNotFoundError:
        raise ValueError(f"File not found: {file_name}")
    except Exception as e:
        logger.error(f"Error reading memory bank file {file_name}: {e}", exc_info=True)
        raise

async def write_memory_bank(p: dict) -> dict:
    """Writes or overwrites content to a file in the memory bank (project/ directory)."""
    file_name = p.get("file_name")
    content = p.get("content")

    if not file_name or content is None:
        raise ValueError("Missing required parameters: 'file_name' and 'content'")

    file_path = _resolve_memory_path(file_name)

    try:
        os.makedirs(PROJECT_DIR, exist_ok=True)
        with open(file_path, 'w', encoding='utf-8') as f:
            f.write(content)
        logger.info(f"Successfully wrote to memory bank file: {file_name}")
        return {"status": "success", "file_path": file_name}
    except Exception as e:
        logger.error(f"Error writing to memory bank file {file_name}: {e}", exc_info=True)
        raise

async def build_and_deploy_service(p: dict) -> dict:
    """
    Triggers the production build and deployment pipeline for the main service.
    This action requires manual approval in the Google Cloud Console.
    """
    branch_to_deploy = p.get("branch", "main")
    logger.info(f"Triggering production deployment for branch: {branch_to_deploy}")

    result = await trigger_build({
        "trigger_id": PROD_BUILD_TRIGGER_ID,
        "branch": branch_to_deploy,
        "substitutions": p.get("substitutions", {})
    })

    return result


async def handle_call_emma(
    arguments: Dict[str, Any],
    caller: CallerContext,
    store: MemoryStore,
) -> CallEmmaResponse:
    """
    Handles the call_emma tool, managing conversation state, memory, and auditing
    for a single turn of conversation with the canonical Emma agent.
    """
    correlation_id = str(uuid.uuid4())
    conversation_id = None
    status = "failure"
    error_type = None
    model_name = None
    history_message_count = 0
    memory_count = 0
    proposed_action_count = 0

    try:
        request = CallEmmaRequest(**arguments)
        conversation_id = request.conversation_id

        if conversation_id:
            conversation = await store.get_conversation(conversation_id, caller.owner_id)
            if not conversation:
                raise ValueError(f"Conversation {conversation_id} not found or access denied.")
        else:
            conversation = await store.create_conversation(
                owner_id=caller.owner_id,
                workspace_id=caller.workspace_id,
                created_by=caller.caller_id
            )
            conversation_id = conversation.conversation_id

        user_message = {
            "message_id": str(uuid.uuid4()),
            "conversation_id": conversation_id,
            "owner_id": caller.owner_id,
            "workspace_id": caller.workspace_id,
            "role": "user",
            "content": request.prompt,
            "created_at": datetime.now(timezone.utc),
            "caller_id": caller.caller_id,
            "correlation_id": correlation_id,
        }
        await store.append_message(conversation_id, user_message)

        history = await store.list_messages(conversation_id, limit=20)
        history_message_count = len(history)

        # Per rule #10, recall_memory is not called as it requires an embedding.
        recalled_memories = []
        memory_count = 0

        if is_call_emma_local_mode_enabled():
            local_emma = CanonicalEmma(
                chat_function=_local_deterministic_emma_chat,
                model="local-test-model"
            )
            emma_for_call = local_emma
        else:
            emma_for_call = canonical_emma

        emma_response = await emma_for_call.run(
            prompt=request.prompt,
            history=history
        )
        model_name = emma_response.get("model")

        assistant_message_content = emma_response.get("response", "")
        assistant_message = {
            "message_id": str(uuid.uuid4()),
            "conversation_id": conversation_id,
            "owner_id": caller.owner_id,
            "workspace_id": caller.workspace_id,
            "role": "assistant",
            "content": assistant_message_content,
            "created_at": datetime.now(timezone.utc),
            "caller_id": "agent:emma",
            "correlation_id": correlation_id,
            "model": model_name,
        }
        await store.append_message(conversation_id, assistant_message)

        status = "success"

        # Proposed actions are not implemented yet
        proposed_actions = []
        proposed_action_count = len(proposed_actions)

        return CallEmmaResponse(
            reply_text=assistant_message_content,
            model=model_name or "unknown",
            conversation_id=conversation_id,
            correlation_id=correlation_id,
            proposed_actions=proposed_actions,
        )

    except Exception as e:
        error_type = type(e).__name__
        logger.error(
            "[handle_call_emma ERROR] correlation_id=%s error_type=%s",
            correlation_id,
            error_type,
        )
        raise RuntimeError(
            "An internal error occurred in handle_call_emma. "
            f"Correlation ID: {correlation_id}"
        ) from None

    finally:
        try:
            event_type = "TOOL_CALL" if status == "success" else "TOOL_CALL_FAILED"
            audit_details = {
                "tool_name": "call_emma",
                "conversation_id": conversation_id,
                "correlation_id": correlation_id,
                "status": status,
                "model": model_name,
                "history_message_count": history_message_count,
                "memory_count": memory_count,
                "proposed_action_count": proposed_action_count,
                "error_type": error_type,
            }
            audit_event = EmmaAuditEvent(
                event_type=event_type,
                caller_id=caller.caller_id,
                details={k: v for k, v in audit_details.items() if v is not None},
                workspace_id=caller.workspace_id,
            )
            await store.record_audit_event(audit_event)
        except Exception as audit_e:
            logger.error(
                "[handle_call_emma AUDIT FAILED] correlation_id=%s audit_error_type=%s",
                correlation_id,
                type(audit_e).__name__,
            )

# ---------------------------------------------------------------------------
# Tool registry + MCP schema
# ---------------------------------------------------------------------------

TOOLS = {
    # Billing
    "get_billing_summary":         (get_billing_summary,         "Hent billing-sammendrag for OPAX", {}),
    "get_billing_forecast": (
        get_billing_forecast,
        "Get billing forecast",
        {},
    ),
    "get_billing_credits": (
        get_billing_credits,
        "Get available billing credits",
        {},
    ),
    "get_billing_anomalies": (
        get_billing_anomalies,
        "Get billing anomalies",
        {},
    ),
    "get_billing_history": (
        get_billing_history,
        "Get billing history",
        {},
    ),
    "get_billing_budget": (
        get_billing_budget,
        "Get the configured billing budget",
        {},
    ),
    "get_telemetry": (
        get_billing_tokens_by_module,
        "Get token and telemetry history by module",
        {},
    ),
    "set_billing_budget":          (set_billing_budget,          "Sett månedlig budsjett", {"type":"object","properties":{"amount":{"type":"number"}}}),
    # Onboarding
    "create_invite":               (create_invite,               "Inviter ny kunde til OPAX", {"type":"object","properties":{"company":{"type":"string"},"email":{"type":"string"},"tier":{"type":"string"}},"required":["email"]}),
    # Notifications
    "send_webhook":                (send_webhook,                "Send webhook-varsling", {"type":"object","properties":{"url":{"type":"string"},"message":{"type":"string"}}}),
    "send_email":                  (send_email,                  "Send e-post via ekstern tjeneste", {"type":"object","properties":{"to":{"type":"string"},"subject":{"type":"string"}},"required":["to","subject"]}),
    "send_sms":                    (send_sms,                    "Send SMS", {"type":"object","properties":{"to":{"type":"string"},"message":{"type":"string"}},"required":["to","message"]}),
    "get_notify_channels": (
        get_notify_channels,
        "List configured notification channels",
        {},
    ),
    # AI Agents
    "run_jason":                   (run_jason,                   "Kjør Jason-agenten med en prompt", {"type":"object","properties":{"prompt":{"type":"string"},"mode":{"type":"string"}},"required":["prompt"]}),
    "run_emma":                    (run_emma,                    "Emma Vauger (gemma3:4b) — primær lokal AI", {"type": "object", "properties": {"prompt": {"type": "string"}, "history": {"type": "array", "items": {"type": "object", "properties": {"role": {"type": "string", "enum": ["user", "assistant"]}, "content": {"type": "string"}}}}}}),

    # Local models — read-only discovery
    "list_emma_models": (
        list_emma_models,
        "List locally available OSVx model names",
        {},
    ),

    # System & Ops
    "get_health":                  (get_health,                  "Hent helsestatus for OPAX", {}),
    "get_build_status":            (get_build_status,            "Hent siste build-status", {}),
    "trigger_build":               (trigger_build,               "Trigger en Cloud Build manuelt", {"type":"object","properties":{"repo":{"type":"string"},"branch":{"type":"string"},"config":{"type":"string"}}}),
    "get_state":                   (get_state,                   "Hent platform-tilstand", {}),
    "list_customers":              (list_customers,              "List alle kunder (alias for get_state)", {}),
    "run_terminal":                (run_terminal,                "Kjør terminalkommando på VM", {"type":"object","properties":{"command":{"type":"string"}}}),
    # Gitea / VCS
    "fetch_and_normalize_source": (
        fetch_and_normalize_source,
        "Fetches and normalizes a repository source archive, returning build metadata.",
        {
            "type": "object",
            "properties": {
                "service_key": {"type": "string"},
                "ref": {"type": "string"},
            },
            "required": ["service_key", "ref"],
        },
    ),
    "list_gitea_repositories":   (list_gitea_repositories,     "Lists repositories in the approved 'chris' namespace. Listing does not grant read, build, or deploy authority.", {}),
    "list_commits":                (list_commits,                "List siste commits i Gitea-repo", {}),
    "get_file":                    (get_file,                    "Hent fil fra Gitea-repo", {"type":"object","properties":{"path":{"type":"string"}, "ref":{"type":"string"}, "repo":{"type":"string"}},"required":["path", "ref"]}),
    "list_repo_files":             (list_repo_files,             "Lists files and directories in a Gitea repository path.", {"type": "object", "properties": {"path": {"type": "string"}}}),
    "propose_gitea_change": (
        propose_gitea_change,
        "Create a pending, one-file Gitea change plan for review; does not apply or commit changes.",
        {
            "type": "object",
            "properties": {
                "repo": {"type": "string"},
                "branch": {"type": "string"},
                "path": {"type": "string"},
                "new_content": {"type": "string"},
                "base_sha": {"type": "string"},
                "commit_message": {"type": "string"}
            },
            "required": ["repo", "branch", "path", "new_content", "base_sha", "commit_message"]
        },
    ),
    # Google Workspace
    "create_email_alias":          (create_email_alias,          "Opprett et nytt e-postalias", {"type":"object","properties":{"user_key":{"type":"string"},"alias":{"type":"string"}},"required":["user_key","alias"]}),
    "list_user_aliases":           (list_user_aliases,           "List en brukers e-postaliaser", {"type":"object","properties":{"user_key":{"type":"string"}},"required":["user_key"]}),
    "delete_email_alias":          (delete_email_alias,          "Slett et e-postalias", {"type":"object","properties":{"user_key":{"type":"string"},"alias":{"type":"string"}},"required":["user_key","alias"]}),
    "send_email_as":               (send_email_as,               "Send en e-post på vegne av en bruker/alias", {"type":"object","properties":{"from":{"type":"string"},"to":{"type":"string"},"subject":{"type":"string"},"body":{"type":"string"}},"required":["from","to","subject","body"]}),
    "get_workspace_user":          (get_workspace_user,          "Hent detaljer for en Workspace-bruker", {"type":"object","properties":{"user_key":{"type":"string"}},"required":["user_key"]}),
    "list_workspace_users":        (list_workspace_users,        "List alle brukere i Workspace-domenet", {}),
    "get_emails":                  (get_emails,                  "Søk i en brukers e-post", {"type":"object","properties":{"user_key":{"type":"string"},"query":{"type":"string"}},"required":["user_key"]}),
    "list_calendar_events":        (list_calendar_events,        "List en brukers kalenderhendelser", {"type":"object","properties":{"user_key":{"type":"string"},"days_ahead":{"type":"integer"}},"required":["user_key"]}),
    # Memory Bank
    "read_memory_bank": (read_memory_bank, "Reads a file from the project memory bank.", {"type": "object", "properties": {"file_name": {"type": "string"}}, "required": ["file_name"]}),
    "write_memory_bank": (write_memory_bank, "Writes a file to the project memory bank.", {"type": "object", "properties": {"file_name": {"type": "string"}, "content": {"type": "string"}}, "required": ["file_name", "content"]}),
    "build_and_deploy_service": (build_and_deploy_service, "Triggers the production build & deployment pipeline.", {"type": "object", "properties": {"branch": {"type": "string"}}, "required": []}),
}

if is_call_emma_local_mode_enabled():
    TOOLS["call_emma"] = (handle_call_emma, "Calls the canonical Emma agent with managed persistence (EMULATOR ONLY)", {"type": "object", "properties": {"prompt": {"type": "string"}}, "required": ["prompt"]})

if provision_new_mcp_module:
    TOOLS["provision_new_mcp_module"] = (provision_new_mcp_module, "Provisions a new MCP module", {"type":"object","properties":{"module_name":{"type":"string"},"tool_name":{"type":"string"},"tool_spec":{"type":"object"}},"required":["module_name","tool_name","tool_spec"]})

# ---------------------------------------------------------------------------
# JSON-RPC Endpoint
# ---------------------------------------------------------------------------

def _jsonrpc_ok(req_id, result):
    return {"jsonrpc": "2.0", "id": req_id, "result": result}
def _jsonrpc_err(req_id, code, message):
    return {"jsonrpc": "2.0", "id": req_id, "error": {"code": code, "message": message}}

@app.post("/")
async def mcp_handler(request: Request):
    await _verify_auth(request)
    try:
        body = await request.json()
    except Exception: return JSONResponse(_jsonrpc_err(None, -32700, "Parse error"), status_code=400)
    method, req_id, params = body.get("method", ""), body.get("id"), body.get("params", {})
    if method == "initialize":
        return JSONResponse(_jsonrpc_ok(req_id, {"protocolVersion": "2024-11-05", "capabilities": {"tools": {}},"serverInfo": {"name": "opax-mcp", "version": "3.6.0"}})) # BUMPED
    if method == "tools/list":
        return JSONResponse(_jsonrpc_ok(req_id, {"tools": [
            {"name": name, "description": desc, "inputSchema": schema if schema else {"type": "object", "properties": {}}}
            for name, (_, desc, schema) in TOOLS.items()
        ]}))
    if method == "tools/call":
        tool_name, tool_args = params.get("name") or params.get("tool"), params.get("arguments", params.get("params", {}))
        entry = TOOLS.get(tool_name)
        if not entry: return JSONResponse(_jsonrpc_err(req_id, -32601, f"Unknown tool: {tool_name}"))
        handler, _, _ = entry
        try:
            if tool_name == "call_emma" and is_call_emma_local_mode_enabled():
                caller = get_call_emma_caller_context()
                store = get_emma_store()
                result = await handler(tool_args, caller, store)
            else:
                result = await handler(tool_args)

                # For call_emma, the result is already the final response object.
            # For other tools, we wrap it.
            if tool_name == "call_emma":
                return JSONResponse(_jsonrpc_ok(req_id, result.model_dump(mode='json')))
            else:
                return JSONResponse(_jsonrpc_ok(req_id, {"content": [{"type": "text", "text": json.dumps(result, ensure_ascii=False)}]}))
        except Exception as e:
            if tool_name == "call_emma":
                error_type = type(e).__name__
                logger.error(
                    "[MCP HANDLER ERROR] tool=%s error_type=%s",
                    tool_name,
                    error_type,
                )
                return JSONResponse(
                    _jsonrpc_err(
                        req_id,
                        -32000,
                        f"Server error in tool 'call_emma': {error_type}",
                    )
                )

            logger.error(f"[MCP HANDLER ERROR] tool={tool_name} {type(e).__name__}: {e}", exc_info=True)
            return JSONResponse(_jsonrpc_err(req_id, -32000, str(e)))
    if method.startswith("notifications/"): return JSONResponse(status_code=202, content={})
    return JSONResponse(_jsonrpc_err(req_id, -32601, f"Method not found: {method}"), status_code=404)

# ---------------------------------------------------------------------------
# Health (keepalive)
# ---------------------------------------------------------------------------

@app.get("/health")
async def health():
    return {"status": "ok", "service": "opax-mcp", "version": "3.6.0"} # BUMPED