package mapping

import (
	"context"
	"errors"
	"fmt"
	"reflect"
	"strings"
	"testing"
	"time"

	commonsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/commonv1"
	semantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionauthoringv1"
	"github.com/pingcap-inc/nexuscrm-contract/wire-go/envelope"
	runtimev1 "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1"
	"google.golang.org/protobuf/proto"
)

func TestPermissionAuthoringMapperPinsObjectGroupSemanticRevision(t *testing.T) {
	if semantic.SemanticMappingRevision != 3 || supportedPermissionAuthoringSemanticMappingRevision != semantic.SemanticMappingRevision {
		t.Fatalf("Permission Authoring mapping revisions = semantic %d, wire %d", semantic.SemanticMappingRevision, supportedPermissionAuthoringSemanticMappingRevision)
	}
}

func TestPermissionAuthoringSnapshotAndFiveFamilySaveRoundTrip(t *testing.T) {
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	token, err := semantic.NewAuthoringToken("ps-1", 7)
	if err != nil {
		t.Fatal(err)
	}
	snapshotRequest := semantic.SnapshotRequest{Target: semantic.Target{Kind: semantic.TargetProfile, ID: "profile-1"}}
	wireSnapshotRequest, err := ToWireReadPermissionAuthoringSnapshotRequest(ctx, snapshotRequest)
	if err != nil {
		t.Fatal(err)
	}
	if decoded, err := FromWireReadPermissionAuthoringSnapshotRequest(ctx, wireSnapshotRequest); err != nil || !reflect.DeepEqual(decoded, snapshotRequest) {
		t.Fatalf("snapshot request = %#v, %v", decoded, err)
	}
	snapshot := semantic.NormalizeSnapshotResponse(semantic.SnapshotResponse{
		CanonicalPermissionSetID: "ps-1", AuthoringToken: token,
		Catalog: semantic.SnapshotCatalog{
			System:      []semantic.SystemPermission{{PermissionID: "ViewSetup", Label: "View Setup", Category: "Setup"}},
			RecordTypes: []semantic.RecordType{{RecordTypeID: "rt-1", ResourceType: "Account", StableName: "Business", Label: "Business", Active: true}},
			Custom:      []semantic.CustomPermission{{PermissionID: "cp-1", StableName: "CanApprove", Label: "Can Approve"}},
		},
		Grants: semantic.StoredGrants{
			System:      []semantic.CapabilityGrant{{CapabilityID: "ViewSetup", Enabled: true}},
			Objects:     []semantic.ObjectGrant{{ResourceType: "Account", Read: true}},
			Fields:      []semantic.FieldGrant{{ResourceType: "Account", FieldName: "Name", Read: true}},
			RecordTypes: []semantic.RecordTypeGrant{{RecordTypeID: "rt-1", Visible: true}},
			Custom:      []semantic.CapabilityGrant{{CapabilityID: "cp-1", Enabled: false}},
		},
		Receipts: permissionAuthoringReceipts(),
	})
	wireSnapshot, err := ToWireReadPermissionAuthoringSnapshotResponse(snapshotRequest, snapshot)
	if err != nil {
		t.Fatal(err)
	}
	if decoded, err := FromWireReadPermissionAuthoringSnapshotResponse(snapshotRequest, wireSnapshot); err != nil || !reflect.DeepEqual(decoded, snapshot) {
		t.Fatalf("snapshot = %#v, %v; want %#v", decoded, err, snapshot)
	}

	request := semantic.Request{
		CommandID: "cmd-1", Target: snapshotRequest.Target, ExpectedAuthoringToken: token,
		Changes: semantic.Changes{
			System:      []semantic.CapabilityGrantChange{{CapabilityID: "ViewSetup", Enabled: false}},
			Objects:     []semantic.ObjectGrantChange{{ResourceType: "Account", Read: true, Edit: true}},
			Fields:      []semantic.FieldGrantChange{{ResourceType: "Account", FieldName: "Name", Read: true, Edit: true}},
			RecordTypes: []semantic.RecordTypeGrantChange{{RecordTypeID: "rt-1", ResourceType: "Account", Visible: false}},
			Custom:      []semantic.CapabilityGrantChange{{CapabilityID: "cp-1", Enabled: true}},
		},
	}
	wireRequest, err := ToWireSavePermissionAuthoringRequest(ctx, request)
	if err != nil {
		t.Fatal(err)
	}
	if decoded, err := FromWireSavePermissionAuthoringRequest(ctx, wireRequest); err != nil || !reflect.DeepEqual(decoded, semantic.NormalizeRequest(request)) {
		t.Fatalf("save request = %#v, %v", decoded, err)
	}
	digest, err := semantic.CommandDigest(request)
	if err != nil {
		t.Fatal(err)
	}
	committedToken, err := semantic.NewAuthoringToken("ps-1", 8)
	if err != nil {
		t.Fatal(err)
	}
	response := semantic.Response{CommandID: request.CommandID, CommandDigest: digest, Outcome: semantic.OutcomeApplied, CanonicalPermissionSetID: "ps-1", AuthoringToken: committedToken, Receipts: permissionAuthoringReceipts(), OutcomeExpiresAtUTC: "2026-08-30T12:00:00Z"}
	wireResponse, err := ToWireSavePermissionAuthoringResponse(request, response)
	if err != nil {
		t.Fatal(err)
	}
	if decoded, err := FromWireSavePermissionAuthoringResponse(request, wireResponse); err != nil || !reflect.DeepEqual(decoded, response) {
		t.Fatalf("save response = %#v, %v", decoded, err)
	}
}

func TestPermissionAuthoringSnapshotRejectsNoncanonicalRecordTypeRowsFromPeer(t *testing.T) {
	request := semantic.SnapshotRequest{
		Target: semantic.Target{Kind: semantic.TargetPermissionSet, ID: "ps-1"},
	}
	token, err := semantic.NewAuthoringToken("ps-1", 1)
	if err != nil {
		t.Fatal(err)
	}
	newResponse := func() *runtimev1.ReadPermissionAuthoringSnapshotResponse {
		return &runtimev1.ReadPermissionAuthoringSnapshotResponse{
			CanonicalPermissionSetId: "ps-1",
			AuthoringToken:           token,
			Catalog: &runtimev1.PermissionAuthoringCatalog{RecordTypes: []*runtimev1.PermissionAuthoringRecordType{{
				RecordTypeId: "rt-1", ResourceType: "Account", StableName: "Business", Label: "Business", Active: true,
			}}},
			Grants: &runtimev1.PermissionAuthoringStoredGrants{RecordTypes: []*runtimev1.PermissionAuthoringRecordTypeGrant{{
				RecordTypeId: "rt-1", Visible: true,
			}}},
			Receipts: toWireReceipts(permissionAuthoringReceipts(), platformCapability(semantic.CapabilityName)),
		}
	}
	tests := []struct {
		name   string
		mutate func(*runtimev1.ReadPermissionAuthoringSnapshotResponse)
	}{
		{
			name: "unknown stored row",
			mutate: func(response *runtimev1.ReadPermissionAuthoringSnapshotResponse) {
				response.Grants.RecordTypes[0].RecordTypeId = "rt-missing"
			},
		},
		{
			name: "inactive stored row",
			mutate: func(response *runtimev1.ReadPermissionAuthoringSnapshotResponse) {
				response.Catalog.RecordTypes[0].Active = false
			},
		},
	}

	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			response := newResponse()
			test.mutate(response)
			_, err := FromWireReadPermissionAuthoringSnapshotResponse(request, response)
			var failure *commonsemantic.Failure
			if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureInternal {
				t.Fatalf("peer snapshot failure = %#v, want INTERNAL", err)
			}
		})
	}
	physicalFalse := newResponse()
	physicalFalse.Grants.RecordTypes[0].Visible = false
	if _, err := FromWireReadPermissionAuthoringSnapshotResponse(request, physicalFalse); err != nil {
		t.Fatalf("ordinary PermissionSet physical false row must remain observable: %v", err)
	}
}

func TestPermissionAuthoringSnapshotResponseNormalizesPeerSemanticLimit(t *testing.T) {
	request := semantic.SnapshotRequest{
		Target: semantic.Target{Kind: semantic.TargetPermissionSet, ID: "ps-1"},
	}
	token, err := semantic.NewAuthoringToken("ps-1", 1)
	if err != nil {
		t.Fatal(err)
	}
	receipts := permissionAuthoringReceipts()
	semanticCatalog := make([]semantic.SystemPermission, 0, semantic.MaxSystemChanges)
	wireCatalog := make([]*runtimev1.PermissionAuthoringSystemPermission, 0, semantic.MaxSystemChanges)
	for index := 0; index < semantic.MaxSystemChanges; index++ {
		permissionID := fmt.Sprintf("p%05d", index)
		label := strings.Repeat("x", 235)
		semanticCatalog = append(semanticCatalog, semantic.SystemPermission{
			PermissionID: permissionID,
			Label:        label,
			Category:     "c",
		})
		wireCatalog = append(wireCatalog, &runtimev1.PermissionAuthoringSystemPermission{
			PermissionId: permissionID,
			Label:        label,
			Category:     "c",
		})
	}
	semanticResponse := semantic.SnapshotResponse{
		CanonicalPermissionSetID: "ps-1",
		AuthoringToken:           token,
		Catalog:                  semantic.SnapshotCatalog{System: semanticCatalog},
		Receipts:                 receipts,
	}
	var semanticFailure *commonsemantic.Failure
	if err := semantic.ValidateSnapshotResponse(request, semanticResponse); !errors.As(err, &semanticFailure) ||
		semanticFailure.Category != commonsemantic.FailureResourceExhausted ||
		semanticFailure.LimitKind != commonsemantic.LimitSemanticResponse {
		t.Fatalf("semantic precondition = %#v, want semantic response limit", err)
	}
	wireResponse := &runtimev1.ReadPermissionAuthoringSnapshotResponse{
		CanonicalPermissionSetId: semanticResponse.CanonicalPermissionSetID,
		AuthoringToken:           semanticResponse.AuthoringToken,
		Catalog:                  &runtimev1.PermissionAuthoringCatalog{System: wireCatalog},
		Grants:                   &runtimev1.PermissionAuthoringStoredGrants{},
		Receipts:                 toWireReceipts(receipts, platformCapability(semantic.CapabilityName)),
	}
	if size := proto.Size(wireResponse); size > envelope.MaxResponseWireBytes {
		t.Fatalf("wire precondition size = %d, want at most %d", size, envelope.MaxResponseWireBytes)
	}
	_, err = FromWireReadPermissionAuthoringSnapshotResponse(request, wireResponse)
	var failure *commonsemantic.Failure
	if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureInternal {
		t.Fatalf("peer semantic limit = %#v, want INTERNAL", err)
	}
}

func TestPermissionAuthoringStatusRoundTripRetainsTerminalIdentityBinding(t *testing.T) {
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	token, _ := semantic.NewAuthoringToken("ps-1", 8)
	request := semantic.Request{CommandID: "cmd-status", Target: semantic.Target{Kind: semantic.TargetPermissionSet, ID: "ps-1"}, ExpectedAuthoringToken: token, Changes: semantic.Changes{System: []semantic.CapabilityGrantChange{{CapabilityID: "ViewSetup", Enabled: true}}}}
	statusRequest, err := semantic.StatusRequestFor(request)
	if err != nil {
		t.Fatal(err)
	}
	wireRequest, err := ToWireGetPermissionAuthoringStatusRequest(ctx, statusRequest)
	if err != nil {
		t.Fatal(err)
	}
	if decoded, err := FromWireGetPermissionAuthoringStatusRequest(ctx, wireRequest); err != nil || decoded != statusRequest {
		t.Fatalf("status request = %#v, %v", decoded, err)
	}
	terminal := semantic.Response{CommandID: request.CommandID, CommandDigest: statusRequest.CommandDigest, Outcome: semantic.OutcomeNoop, CanonicalPermissionSetID: "ps-1", AuthoringToken: token, Receipts: permissionAuthoringReceipts(), OutcomeExpiresAtUTC: "2026-08-30T12:00:00Z"}
	response := semantic.StatusResponse{CommandID: request.CommandID, CommandDigest: statusRequest.CommandDigest, State: semantic.CommandCompleted, Result: &terminal}
	wireResponse, err := ToWireGetPermissionAuthoringStatusResponseForRequest(request, response)
	if err != nil {
		t.Fatal(err)
	}
	if decoded, err := FromWireGetPermissionAuthoringStatusResponseForRequest(request, wireResponse); err != nil || !reflect.DeepEqual(decoded, response) {
		t.Fatalf("status response = %#v, %v", decoded, err)
	}
}

func TestPermissionAuthoringSaveMappingRejectsInvalidTerminalTransition(t *testing.T) {
	baselineToken, err := semantic.NewAuthoringToken("ps-1", 7)
	if err != nil {
		t.Fatal(err)
	}
	request := semantic.Request{
		CommandID:              "cmd-transition",
		Target:                 semantic.Target{Kind: semantic.TargetProfile, ID: "profile-1"},
		ExpectedAuthoringToken: baselineToken,
		Changes:                semantic.Changes{System: []semantic.CapabilityGrantChange{{CapabilityID: "ViewSetup", Enabled: true}}},
	}
	digest, err := semantic.CommandDigest(request)
	if err != nil {
		t.Fatal(err)
	}
	token := func(permissionSetID string, revision uint64) string {
		value, tokenErr := semantic.NewAuthoringToken(permissionSetID, revision)
		if tokenErr != nil {
			t.Fatal(tokenErr)
		}
		return value
	}
	tests := []struct {
		name       string
		outcome    semantic.Outcome
		responseID string
		revision   uint64
	}{
		{name: "Profile aggregate substitution", outcome: semantic.OutcomeApplied, responseID: "ps-2", revision: 8},
		{name: "applied preserves revision", outcome: semantic.OutcomeApplied, responseID: "ps-1", revision: 7},
		{name: "applied skips revision", outcome: semantic.OutcomeApplied, responseID: "ps-1", revision: 9},
		{name: "noop advances revision", outcome: semantic.OutcomeNoop, responseID: "ps-1", revision: 8},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			response := semantic.Response{
				CommandID: request.CommandID, CommandDigest: digest, Outcome: test.outcome,
				CanonicalPermissionSetID: test.responseID, AuthoringToken: token(test.responseID, test.revision),
				Receipts: permissionAuthoringReceipts(), OutcomeExpiresAtUTC: "2026-08-30T12:00:00Z",
			}
			if _, err := ToWireSavePermissionAuthoringResponse(request, response); err == nil {
				t.Fatal("semantic-to-wire mapping accepted an invalid terminal transition")
			}
			wireResponse, err := toWirePermissionAuthoringTerminal(response)
			if err != nil {
				t.Fatal(err)
			}
			if _, err := FromWireSavePermissionAuthoringResponse(request, wireResponse); err == nil {
				t.Fatal("wire-to-semantic mapping accepted an invalid terminal transition")
			}
		})
	}
}

func TestPermissionAuthoringStatusRequestBoundMappingRejectsWrongTerminal(t *testing.T) {
	baselineToken, err := semantic.NewAuthoringToken("ps-1", 7)
	if err != nil {
		t.Fatal(err)
	}
	request := semantic.Request{
		CommandID:              "cmd-status-transition",
		Target:                 semantic.Target{Kind: semantic.TargetProfile, ID: "profile-1"},
		ExpectedAuthoringToken: baselineToken,
		Changes:                semantic.Changes{System: []semantic.CapabilityGrantChange{{CapabilityID: "ViewSetup", Enabled: true}}},
	}
	statusRequest, err := semantic.StatusRequestFor(request)
	if err != nil {
		t.Fatal(err)
	}
	wrongToken, err := semantic.NewAuthoringToken("ps-2", 8)
	if err != nil {
		t.Fatal(err)
	}
	terminal := semantic.Response{
		CommandID: request.CommandID, CommandDigest: statusRequest.CommandDigest, Outcome: semantic.OutcomeApplied,
		CanonicalPermissionSetID: "ps-2", AuthoringToken: wrongToken,
		Receipts: permissionAuthoringReceipts(), OutcomeExpiresAtUTC: "2026-08-30T12:00:00Z",
	}
	response := semantic.StatusResponse{
		CommandID: request.CommandID, CommandDigest: statusRequest.CommandDigest,
		State: semantic.CommandCompleted, Result: &terminal,
	}
	wireResponse, err := ToWireGetPermissionAuthoringStatusResponse(statusRequest, response)
	if err != nil {
		t.Fatalf("request-independent status shape should remain valid: %v", err)
	}
	if _, err := ToWireGetPermissionAuthoringStatusResponseForRequest(request, response); err == nil {
		t.Fatal("request-bound semantic-to-wire mapping accepted the wrong aggregate")
	}
	if _, err := FromWireGetPermissionAuthoringStatusResponseForRequest(request, wireResponse); err == nil {
		t.Fatal("request-bound wire-to-semantic mapping accepted the wrong aggregate")
	}
}

func TestPermissionAuthoringMappingRejectsUnknownWireEnums(t *testing.T) {
	token, err := semantic.NewAuthoringToken("ps-1", 7)
	if err != nil {
		t.Fatal(err)
	}
	request := semantic.Request{
		CommandID: "cmd-unknown-rejection", Target: semantic.Target{Kind: semantic.TargetPermissionSet, ID: "ps-1"},
		ExpectedAuthoringToken: token,
		Changes:                semantic.Changes{System: []semantic.CapabilityGrantChange{{CapabilityID: "ViewSetup", Enabled: true}}},
	}
	digest, err := semantic.CommandDigest(request)
	if err != nil {
		t.Fatal(err)
	}
	committedToken, err := semantic.NewAuthoringToken("ps-1", 8)
	if err != nil {
		t.Fatal(err)
	}
	terminal := semantic.Response{
		CommandID: request.CommandID, CommandDigest: digest, Outcome: semantic.OutcomeApplied,
		CanonicalPermissionSetID: "ps-1", AuthoringToken: committedToken,
		Receipts: permissionAuthoringReceipts(), OutcomeExpiresAtUTC: "2026-08-30T12:00:00Z",
	}
	wireTerminal, err := ToWireSavePermissionAuthoringResponse(request, terminal)
	if err != nil {
		t.Fatal(err)
	}
	wireTerminal.RejectionCode = runtimev1.PermissionAuthoringRejectionCode(99)
	if _, err := FromWireSavePermissionAuthoringResponse(request, wireTerminal); err == nil {
		t.Fatal("save response accepted an unknown rejection-code enum as successful NONE")
	}
	wireTerminal.RejectionCode = runtimev1.PermissionAuthoringRejectionCode_PERMISSION_AUTHORING_REJECTION_CODE_UNSPECIFIED
	wireTerminal.Outcome = runtimev1.PermissionAuthoringOutcome(99)
	if _, err := FromWireSavePermissionAuthoringResponse(request, wireTerminal); err == nil {
		t.Fatal("save response accepted an unknown outcome enum")
	}
	wireTerminal.Outcome = runtimev1.PermissionAuthoringOutcome_PERMISSION_AUTHORING_OUTCOME_APPLIED

	statusRequest, err := semantic.StatusRequestFor(request)
	if err != nil {
		t.Fatal(err)
	}
	wireStatus := &runtimev1.GetPermissionAuthoringStatusResponse{
		CommandId: request.CommandID, SemanticSha256: append([]byte(nil), wireTerminal.GetSemanticSha256()...),
		State:  runtimev1.PermissionAuthoringCommandState_PERMISSION_AUTHORING_COMMAND_STATE_COMPLETED,
		Result: wireTerminal,
	}
	wireTerminal.RejectionCode = runtimev1.PermissionAuthoringRejectionCode(99)
	if _, err := FromWireGetPermissionAuthoringStatusResponse(statusRequest, wireStatus); err == nil {
		t.Fatal("status response accepted an unknown rejection-code enum as successful NONE")
	}
	wireTerminal.RejectionCode = runtimev1.PermissionAuthoringRejectionCode_PERMISSION_AUTHORING_REJECTION_CODE_UNSPECIFIED
	wireStatus.State = runtimev1.PermissionAuthoringCommandState(99)
	if _, err := FromWireGetPermissionAuthoringStatusResponse(statusRequest, wireStatus); err == nil {
		t.Fatal("status response accepted an unknown command-state enum")
	}
}

func TestPermissionAuthoringSavePreflightPreservesFamilyCeilings(t *testing.T) {
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	tests := []struct {
		name    string
		changes *runtimev1.PermissionAuthoringChanges
		kind    commonsemantic.LimitKind
		maximum uint64
	}{
		{
			name: "system", kind: commonsemantic.LimitOperationCount, maximum: semantic.MaxSystemChanges,
			changes: &runtimev1.PermissionAuthoringChanges{System: make([]*runtimev1.PermissionAuthoringCapabilityGrantChange, semantic.MaxSystemChanges+1)},
		},
		{
			name: "custom", kind: commonsemantic.LimitOperationCount, maximum: semantic.MaxCustomChanges,
			changes: &runtimev1.PermissionAuthoringChanges{Custom: make([]*runtimev1.PermissionAuthoringCapabilityGrantChange, semantic.MaxCustomChanges+1)},
		},
		{
			name: "object", kind: commonsemantic.LimitOperationCount, maximum: semantic.MaxObjectChanges,
			changes: &runtimev1.PermissionAuthoringChanges{Objects: make([]*runtimev1.PermissionAuthoringObjectGrantChange, semantic.MaxObjectChanges+1)},
		},
		{
			name: "record type", kind: commonsemantic.LimitOperationCount, maximum: semantic.MaxRecordTypeChanges,
			changes: &runtimev1.PermissionAuthoringChanges{RecordTypes: make([]*runtimev1.PermissionAuthoringRecordTypeGrantChange, semantic.MaxRecordTypeChanges+1)},
		},
		{
			name: "field", kind: commonsemantic.LimitFieldCount, maximum: semantic.MaxFieldChanges,
			changes: &runtimev1.PermissionAuthoringChanges{Fields: make([]*runtimev1.PermissionAuthoringFieldGrantChange, semantic.MaxFieldChanges+1)},
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			wireRequest := &runtimev1.SavePermissionAuthoringRequest{
				Target: &runtimev1.PermissionAuthoringTarget{
					Kind: runtimev1.PermissionAuthoringTargetKind_PERMISSION_AUTHORING_TARGET_KIND_PROFILE,
					Id:   "profile-1",
				},
				Changes: test.changes,
			}
			_, err := FromWireSavePermissionAuthoringRequest(ctx, wireRequest)
			var failure *commonsemantic.Failure
			if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureResourceExhausted ||
				failure.LimitKind != test.kind || failure.Maximum != test.maximum {
				t.Fatalf("preflight failure = %#v, want kind %s maximum %d", err, test.kind, test.maximum)
			}
			decoded := FromPlatformStatusError(
				ToPlatformStatusError(failure, semantic.CapabilityName), semantic.CapabilityName,
			)
			var roundTrip *commonsemantic.Failure
			if !errors.As(decoded, &roundTrip) || roundTrip.Category != failure.Category ||
				roundTrip.LimitKind != failure.LimitKind || roundTrip.Maximum != failure.Maximum {
				t.Fatalf("status round trip = %#v, want %#v", decoded, failure)
			}
		})
	}
}

func TestPermissionAuthoringStatusMappingPreservesContractLimits(t *testing.T) {
	limits := []struct {
		kind    commonsemantic.LimitKind
		maximum uint64
	}{
		{kind: commonsemantic.LimitCommandID, maximum: semantic.MaxCommandIdentifierBytes},
		{kind: commonsemantic.LimitSemanticRequest, maximum: semantic.MaxSemanticRequestBytes},
		{kind: commonsemantic.LimitSemanticResponse, maximum: semantic.MaxSemanticResponseBytes},
		{kind: commonsemantic.LimitSemanticResponse, maximum: semantic.MaxSnapshotResponseBytes},
		{kind: commonsemantic.LimitWireFrame, maximum: envelope.MaxRequestWireBytes},
	}
	for _, limit := range limits {
		source := &commonsemantic.Failure{
			Category:  commonsemantic.FailureResourceExhausted,
			LimitKind: limit.kind, Maximum: limit.maximum,
		}
		decoded := FromPlatformStatusError(
			ToPlatformStatusError(source, semantic.CapabilityName), semantic.CapabilityName,
		)
		var failure *commonsemantic.Failure
		if !errors.As(decoded, &failure) || failure.Category != source.Category ||
			failure.LimitKind != source.LimitKind || failure.Maximum != source.Maximum {
			t.Fatalf("status round trip = %#v, want %#v", decoded, source)
		}
	}

	invalid := &commonsemantic.Failure{
		Category:  commonsemantic.FailureResourceExhausted,
		LimitKind: commonsemantic.LimitOperationCount, Maximum: semantic.MaxObjectChanges + 1,
	}
	decoded := FromPlatformStatusError(
		ToPlatformStatusError(invalid, semantic.CapabilityName), semantic.CapabilityName,
	)
	var failure *commonsemantic.Failure
	if !errors.As(decoded, &failure) || failure.Category != commonsemantic.FailureInternal {
		t.Fatalf("unknown Permission Authoring limit did not fail closed: %#v", decoded)
	}
}

func permissionAuthoringReceipts() semantic.Receipts {
	return semantic.Receipts{ProtocolVersion: "1.0", CapabilityVersion: semantic.CapabilityName, CatalogRevision: 7, SchemaGeneration: 2, EngineGeneration: 3, SecurityEpoch: 4}
}