package teamworkflow

import (
	"errors"
	"net/http"
	"testing"

	"github.com/stretchr/testify/require"

	"github.com/tidbcloud/AgentTeam/internal/store/storeerr"
)

func TestClassifyErrorUsesRedactionAndNonEnumeration(t *testing.T) {
	// Non-protected store semantics keep their HTTP status and the resolved
	// team_workflow default code, but never project verbatim store text.
	response, ok := classifyError(storeerr.BadRequest("raw bad request"))
	require.True(t, ok)
	require.Equal(t, http.StatusBadRequest, response.Status)
	require.Equal(t, "team_workflow_request_failed", response.Code)
	require.NotContains(t, response.Message, "raw bad request")

	response, ok = classifyError(storeerr.Conflict("raw conflict"))
	require.True(t, ok)
	require.Equal(t, http.StatusConflict, response.Status)
	require.Equal(t, "team_workflow_request_failed", response.Code)
	require.NotContains(t, response.Message, "raw conflict")

	response, ok = classifyError(storeerr.New(storeerr.ErrUnprocessable, "raw invalid"))
	require.True(t, ok)
	require.Equal(t, http.StatusUnprocessableEntity, response.Status)
	require.Equal(t, "team_workflow_request_failed", response.Code)
	require.NotContains(t, response.Message, "raw invalid")
}

func TestClassifyErrorCollapsesProtectedSelectorsToByteIdenticalNotFound(t *testing.T) {
	// A raw store NotFound and a raw store Forbidden selector project one
	// byte-identical 404 team_workflow_not_found contract so a caller cannot
	// tell whether a Team Workflow resource exists or is merely inaccessible
	// across tenants.
	notFound, ok := classifyError(storeerr.NotFound("Team Workflow twf_secret is missing"))
	require.True(t, ok)
	forbidden, ok := classifyError(storeerr.Forbidden("Team Workflow twf_secret is forbidden"))
	require.True(t, ok)

	require.Equal(t, http.StatusNotFound, notFound.Status)
	require.Equal(t, http.StatusNotFound, forbidden.Status)
	require.Equal(t, "team_workflow_not_found", notFound.Code)
	require.Equal(t, notFound.Code, forbidden.Code)
	require.Equal(t, notFound.Message, forbidden.Message)
	require.Equal(t, "team_workflow", notFound.Stage)
	require.NotContains(t, notFound.Message, "twf_secret")
	require.NotContains(t, forbidden.Message, "twf_secret")
	require.Nil(t, notFound.Details)
	require.Nil(t, forbidden.Details)
}

func TestClassifyErrorUnknownFailureFailsClosed(t *testing.T) {
	// Unknown failures fail closed to a generic internal error instead of
	// leaking raw text or returning false (which would route to the generic
	// StoreError writer and project the raw error).
	response, ok := classifyError(errors.New("raw repository: dial tcp: SELECT secret FROM team_workflows"))
	require.True(t, ok)
	require.Equal(t, http.StatusInternalServerError, response.Status)
	require.Equal(t, "team_workflow_request_failed", response.Code)
	require.NotContains(t, response.Message, "dial tcp")
	require.NotContains(t, response.Message, "secret")
	require.Nil(t, response.Details)
}