package boundary_test

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

// L0-B / B1c anti-regrowth seal (scoped).
//
// B1c removed the hardcoded Salesforce v63 generic-500 from the app-blind global
// error handler: backend/internal/host/adapters/apihost/middleware/error_handler.go
// no longer calls apierr.SFGenericInternalErrorResponse — the wire body for an
// internal error is supplied by an injected L1 (CRM) projector, with a neutral L0
// default. boundarygate does NOT scan backend/, so without this seal the hardcoded
// SF generic-500 could silently regrow there.
//
// This seal is SCOPED to the generic-500 site. It deliberately does NOT require the
// whole middleware package to be apierr.SF*-free: the *apierr.SalesforceAPIError
// pass-through arm and auth.go's SF refs are legitimate until PR-6 / the auth-code
// follow-up. The check is only: error_handler.go must not mint the SF generic-500.
func TestAPIHostErrorHandlerHasNoSalesforceGeneric500(t *testing.T) {
	root := repoRoot(t)
	file := filepath.Join(root, "backend", "internal", "host", "adapters", "apihost", "middleware", "error_handler.go")

	b, err := os.ReadFile(file)
	if err != nil {
		t.Fatalf("read %s: %v", file, err)
	}
	if n := strings.Count(string(b), "SFGenericInternalErrorResponse"); n != 0 {
		t.Fatalf("apihost GlobalErrorHandler reintroduced the hardcoded Salesforce generic-500: "+
			"error_handler.go calls SFGenericInternalErrorResponse %d time(s). The generic internal-error "+
			"wire body must come from the injected L1 InternalErrorProjector, with a neutral L0 default.", n)
	}
}