package converter

import (
	"testing"
	"time"

	"github.com/stretchr/testify/require"

	"github.com/tidbcloud/AgentTeam/internal/extension/runner"
	"github.com/tidbcloud/AgentTeam/internal/store/app"
)

// TestToExtensionProviderConnectionResponseProjectsPerFieldConfigured locks
// the server-side projection: the per-field configured flags come from each
// field's stored value, never from the aggregate credentialSet, so a
// connection holding only the required webhook token must report the
// optional signing secret as unconfigured.
func TestToExtensionProviderConnectionResponseProjectsPerFieldConfigured(t *testing.T) {
	t.Parallel()

	updatedAt := time.Date(2026, 8, 18, 0, 0, 0, 0, time.UTC)
	view := app.ExtensionProviderConnectionView{
		Active:        true,
		Slug:          "feishucustombot",
		CredentialSet: true,
		UpdatedAt:     &updatedAt,
	}
	fields := []runner.CredentialField{
		{Name: "apiKey", DisplayName: "Webhook token", Required: true, Secret: true},
		{Name: "signingSecret", DisplayName: "Signing secret", Required: false, Secret: true},
	}
	credentials := map[string]string{"apiKey": "stored-token"}

	projected := ToExtensionProviderConnectionResponse(view, fields, credentials)

	require.True(t, projected.CredentialSet, "aggregate stays true")
	require.Len(t, projected.Fields, 2)
	configuredByName := map[string]bool{}
	for _, field := range projected.Fields {
		configuredByName[field.Name] = field.Configured
	}
	require.True(t, configuredByName["apiKey"])
	require.False(t, configuredByName["signingSecret"],
		"an unstored optional secret must not inherit the aggregate flag")
	require.NotContains(t, projected.Values, "apiKey",
		"secret values never round-trip into the response")
}