package teamworkflow

import (
	"github.com/tidbcloud/AgentTeam/internal/api"
	"github.com/tidbcloud/AgentTeam/internal/store/storeerr"
	"github.com/tidbcloud/AgentTeam/internal/workflow/publicerr"
)

// publicError constructs a canonical API-layer domain error that the shared
// classifier projects into the canonical public Workflow error contract.
func publicError(status int, code string, problem string) error {
	return publicerr.WorkflowError{
		Kind: storeerr.ErrBadRequest, Status: status, Code: code, Problem: problem,
	}
}

// classifyError projects a Team Workflow failure through the same canonical
// public Workflow redaction and non-enumeration policy used by the other
// workflow management domains. Verbatim err.Error() text is never projected
// (raw store text stays internal), and protected-resource selectors that are
// missing or cross-tenant/forbidden collapse to one byte-identical 404
// team_workflow_not_found contract so a caller cannot enumerate Team Workflow
// resources across tenants.
func classifyError(err error) (api.ErrorResponse, bool) {
	classified, ok := publicerr.Classify(err, publicerr.Options{
		Stage:       publicerr.StageTeamWorkflow,
		DefaultCode: "team_workflow_request_failed",
		ProtectedSelectors: map[string]string{
			"team_workflow_not_found": "team_workflow_not_found",
		},
		ProtectedNotFoundCode: "team_workflow_not_found",
	})
	if !ok {
		return api.ErrorResponse{}, false
	}
	return api.ErrorResponse{
		Status: classified.Status, Message: classified.Error.Problem,
		Code: classified.Error.Code, Details: classified.Details,
		Stage: string(classified.Error.Stage), Path: classified.Error.Path,
		Hint: classified.Error.Hint, Retryable: classified.Error.Retryable,
		Diagnostics: classified.Error.Diagnostics,
	}, true
}