package packs

import (
	"strings"
	"testing"
)

// The standard-action seeder + verifier were relocated from internal/bootstrap
// to internal/controlplane/packs in Wave 5, so this structural guard now reads
// the packs sources via the package-local readPacksSourceForStructure helper
// (pack_source_validation_helpers_structure_test.go).
func TestStandardActionVerifyStaysOutOfSeeder(t *testing.T) {
	seederSrc := readPacksSourceForStructure(t, "standard_actions.go")
	verifySrc := readPacksSourceForStructure(t, "standard_actions_verify.go")

	for _, symbol := range []string{
		"func VerifyStandardActionsForOwnerFromPayload(",
		"func verifyStandardActionSchemaRows(",
		"func verifyStandardActionFieldDefaultRows(",
		"func verifyStandardActionInputGuardRows(",
		"func verifyStandardActionInternalAccessScopeRows(",
		"func verifyNoStaleStandardActionRows",
	} {
		if strings.Contains(seederSrc, symbol) {
			t.Fatalf("standard_actions.go still owns verify symbol %q", symbol)
		}
		if !strings.Contains(verifySrc, symbol) {
			t.Fatalf("standard_actions_verify.go is missing verify symbol %q", symbol)
		}
	}
}

func TestStandardActionSourcesDoNotOwnCustomPermissionPersistence(t *testing.T) {
	seederSrc := readPacksSourceForStructure(t, "standard_actions.go")
	verifySrc := readPacksSourceForStructure(t, "standard_actions_verify.go")

	for _, forbidden := range []string{
		"_System_CustomPermission",
		"func upsertActionCustomPermissions(",
		"func claimActionCustomPermissionBusinessKeys(",
		"func reconcileActionCustomPermissionRemovals(",
		"func verifyStandardActionCustomPermissionRows(",
	} {
		if strings.Contains(seederSrc, forbidden) {
			t.Fatalf("standard_actions.go still owns custom-permission persistence symbol %q", forbidden)
		}
		if strings.Contains(verifySrc, forbidden) {
			t.Fatalf("standard_actions_verify.go still owns custom-permission persistence symbol %q", forbidden)
		}
	}
}