package extension

import (
	"net/http"

	"github.com/tidbcloud/AgentTeam/internal/api"
	"github.com/tidbcloud/AgentTeam/internal/service/extensionflow"
)

func classifyInvocationError(err error) error {
	code, ok := extensionflow.InvocationErrorCodeOf(err)
	if !ok {
		return api.NewHTTPErrorWithCodeAndCause(
			http.StatusInternalServerError,
			"extension invocation failed",
			string(extensionflow.InvocationInternal),
			err,
		)
	}
	status := http.StatusInternalServerError
	switch code {
	case extensionflow.InvocationValidation:
		status = http.StatusBadRequest
	case extensionflow.InvocationPermissionDenied:
		status = http.StatusForbidden
	case extensionflow.InvocationNotFound:
		status = http.StatusNotFound
	case extensionflow.InvocationConflict:
		status = http.StatusConflict
	case extensionflow.InvocationAgentCatalogStale:
		status = http.StatusConflict
	case extensionflow.InvocationProviderAuthUnavailable:
		status = http.StatusServiceUnavailable
	case extensionflow.InvocationRateLimited:
		status = http.StatusTooManyRequests
	case extensionflow.InvocationUpstreamFailure:
		status = http.StatusBadGateway
	case extensionflow.InvocationInternal:
		status = http.StatusInternalServerError
	}
	// InvocationError.Error() is deliberately safe and excludes its internal
	// provider/network cause. Keep that safe wrapper as the API cause too so
	// error observation cannot serialize or log credential-bearing URLs.
	return api.NewHTTPErrorWithCodeAndCause(
		status,
		err.Error(),
		string(code),
		err,
	)
}