package spec

import (
	"strings"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// TestValidateAuthProfileID_Contract proves the blocker-3 publication contract
// (stage-5 round-3): an auth-profile id is an EXACT identity — non-empty, no
// surrounding whitespace (never trimmed/normalized), and bounded by the durable
// maxAuthProfileIDLength so authoring, Registry, store, and schema enforce one
// limit.
func TestValidateAuthProfileID_Contract(t *testing.T) {
	t.Parallel()
	cases := []struct {
		name    string
		id      string
		wantErr string
	}{
		{"empty", "", "must be set"},
		{"leading whitespace", " default", "surrounding whitespace"},
		{"trailing whitespace", "default ", "surrounding whitespace"},
		{"interior normal", "default", ""},
		{"kebab", "github-oauth", ""},
		{"at limit (255)", strings.Repeat("a", maxAuthProfileIDLength), ""},
		{"under limit (254)", strings.Repeat("a", maxAuthProfileIDLength-1), ""},
		{"over limit (256)", strings.Repeat("a", maxAuthProfileIDLength+1), "exceeds the"},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			err := validateAuthProfileID(tc.id)
			if tc.wantErr == "" {
				require.NoError(t, err)
				return
			}
			require.Error(t, err)
			assert.Contains(t, err.Error(), tc.wantErr)
		})
	}
}