package serviceactor

import (
	"context"
	"database/sql"
	"fmt"
	"regexp"
	"time"

	"github.com/tidbcloud/AgentTeam/internal/coredb"
	"github.com/tidbcloud/AgentTeam/internal/store/model"
)

const (
	InstallationExtensionSourceAppDefault = "app_default"
	InstallationExtensionSourceUser       = "user"
)

var installationExtensionDigestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)
var installationExtensionNamePattern = regexp.MustCompile(`^[a-z0-9]+(?:-[a-z0-9]+)*$`)

// InstallationExtension is a secret-free Extension selection hosted by an App
// Service Installation.
type InstallationExtension struct {
	ID                    string
	WorkspaceID           string
	ServiceDefinitionID   string
	ServiceInstallationID string
	ExtensionName         string
	DefinitionDomain      string
	DefinitionVersion     int
	DefinitionDigest      string
	Status                string
	DisabledReason        string
	Config                []byte
	SelectionSource       string
	CreatedByMemberID     string
	CreatedAt             time.Time
	UpdatedAt             time.Time
	DisabledAt            *time.Time
}

// InstallationExtensionUpsert describes a Service Installation Extension
// selection write.
type InstallationExtensionUpsert struct {
	InstallationExtension
	Now time.Time
}

// UpsertInstallationExtension creates or updates a selection atomically.
func (store *Store) UpsertInstallationExtension(ctx context.Context, params InstallationExtensionUpsert) (InstallationExtension, error) {
	if _, err := execerFromStore(store); err != nil {
		return InstallationExtension{}, err
	}
	var selection InstallationExtension
	err := coredb.WithTx(ctx, store.db, func(tx coredb.Tx) error {
		var err error
		selection, err = upsertInstallationExtension(ctx, tx, params)
		return err
	})
	return selection, err
}

// UpsertInstallationExtension creates or updates a selection in the
// caller-owned transaction.
func (store *TxStore) UpsertInstallationExtension(ctx context.Context, params InstallationExtensionUpsert) (InstallationExtension, error) {
	execer, err := execerFromTxStore(store)
	if err != nil {
		return InstallationExtension{}, err
	}
	return upsertInstallationExtension(ctx, execer, params)
}

// DisableInstallationExtension disables one selection and releases its
// Workspace-visible Extension name.
func (store *Store) DisableInstallationExtension(ctx context.Context, workspaceID string, selectionID string, reason string, now time.Time) (InstallationExtension, error) {
	if _, err := execerFromStore(store); err != nil {
		return InstallationExtension{}, err
	}
	var selection InstallationExtension
	err := coredb.WithTx(ctx, store.db, func(tx coredb.Tx) error {
		var err error
		selection, err = disableInstallationExtension(ctx, tx, workspaceID, selectionID, reason, now)
		return err
	})
	return selection, err
}

// DisableInstallationExtension disables one selection in the caller-owned
// transaction.
func (store *TxStore) DisableInstallationExtension(ctx context.Context, workspaceID string, selectionID string, reason string, now time.Time) (InstallationExtension, error) {
	execer, err := execerFromTxStore(store)
	if err != nil {
		return InstallationExtension{}, err
	}
	return disableInstallationExtension(ctx, execer, workspaceID, selectionID, reason, now)
}

// ListInstallationExtensions lists all selections under one App Installation.
func (store *Store) ListInstallationExtensions(ctx context.Context, workspaceID string, serviceInstallationID string) ([]InstallationExtension, error) {
	queryer, err := queryerFromStore(store)
	if err != nil {
		return nil, err
	}
	return listInstallationExtensions(ctx, queryer, workspaceID, serviceInstallationID)
}

// ListInstallationExtensions lists selections in the caller-owned transaction.
func (store *TxStore) ListInstallationExtensions(ctx context.Context, workspaceID string, serviceInstallationID string) ([]InstallationExtension, error) {
	queryer, err := queryerFromTxStore(store)
	if err != nil {
		return nil, err
	}
	return listInstallationExtensions(ctx, queryer, workspaceID, serviceInstallationID)
}

// LoadActiveInstallationExtensionByNameForUpdate locks the active Workspace
// name claim and validates its App host.
func (store *TxStore) LoadActiveInstallationExtensionByNameForUpdate(ctx context.Context, workspaceID string, extensionName string) (InstallationExtension, bool, error) {
	execer, err := execerFromTxStore(store)
	if err != nil {
		return InstallationExtension{}, false, err
	}
	selection, found, err := loadActiveInstallationExtensionByNameForUpdate(ctx, execer, workspaceID, extensionName)
	if err != nil || !found {
		return InstallationExtension{}, found, err
	}
	if err := validateInstallationExtensionHost(ctx, execer, selection, true); err != nil {
		return InstallationExtension{}, false, err
	}
	return selection, true, nil
}

func upsertInstallationExtension(ctx context.Context, execer coredb.QueryExecer, params InstallationExtensionUpsert) (InstallationExtension, error) {
	selection, now, err := normalizeInstallationExtensionUpsert(params)
	if err != nil {
		return InstallationExtension{}, err
	}

	existingByID, foundByID, err := loadInstallationExtensionByID(ctx, execer, selection.ID, true)
	if err != nil {
		return InstallationExtension{}, err
	}
	if foundByID && !installationExtensionIdentityMatches(existingByID, selection) {
		return InstallationExtension{}, conflict("Service Installation Extension id is already bound to another durable identity.")
	}
	existingByDomain, foundByDomain, err := loadInstallationExtensionByDomainForUpdate(
		ctx,
		execer,
		selection.ServiceInstallationID,
		selection.DefinitionDomain,
	)
	if err != nil {
		return InstallationExtension{}, err
	}
	if foundByDomain && existingByDomain.ID != selection.ID {
		return InstallationExtension{}, conflict("Extension domain is already selected for this Service Installation.")
	}
	if err := validateInstallationExtensionHost(ctx, execer, selection, true); err != nil {
		return InstallationExtension{}, err
	}

	if foundByID || foundByDomain {
		_, err := execer.Exec(ctx, `
UPDATE service_installation_extensions
SET extension_name = $5,
    definition_version = $7,
    definition_digest = $8,
    status = $9,
    disabled_reason = $10,
    config = $11,
    selection_source = $12,
    updated_at = $13,
    disabled_at = $14
WHERE id = $1
  AND workspace_id = $2
  AND service_definition_id = $3
  AND service_installation_id = $4
  AND definition_domain = $6
`, selection.ID, selection.WorkspaceID, selection.ServiceDefinitionID, selection.ServiceInstallationID,
			selection.ExtensionName, selection.DefinitionDomain, selection.DefinitionVersion,
			selection.DefinitionDigest, selection.Status, selection.DisabledReason, selection.Config,
			selection.SelectionSource, now, nullTimePtr(selection.DisabledAt))
		if err != nil {
			return InstallationExtension{}, fmt.Errorf("update Service Installation Extension: %w", mapInstallationExtensionWriteError(err))
		}
		persisted, found, err := loadInstallationExtensionByID(ctx, execer, selection.ID, false)
		if err != nil {
			return InstallationExtension{}, err
		}
		if !found {
			return InstallationExtension{}, notFound("Service Installation Extension not found")
		}
		return persisted, nil
	}

	if _, err := execer.Exec(ctx, `
INSERT INTO service_installation_extensions (
    id, workspace_id, service_definition_id, service_installation_id,
    extension_name, definition_domain, definition_version, definition_digest,
    status, disabled_reason, config, selection_source, created_by_member_id,
    created_at, updated_at, disabled_at
) VALUES (
    $1, $2, $3, $4,
    $5, $6, $7, $8,
    $9, $10, $11, $12, $13,
    $14, $14, $15
)
`, selection.ID, selection.WorkspaceID, selection.ServiceDefinitionID, selection.ServiceInstallationID,
		selection.ExtensionName, selection.DefinitionDomain, selection.DefinitionVersion,
		selection.DefinitionDigest, selection.Status, selection.DisabledReason, selection.Config,
		selection.SelectionSource, selection.CreatedByMemberID, now, nullTimePtr(selection.DisabledAt)); err != nil {
		return InstallationExtension{}, fmt.Errorf("insert Service Installation Extension: %w", mapInstallationExtensionWriteError(err))
	}
	persisted, found, err := loadInstallationExtensionByID(ctx, execer, selection.ID, false)
	if err != nil {
		return InstallationExtension{}, err
	}
	if !found {
		return InstallationExtension{}, notFound("Service Installation Extension not found")
	}
	return persisted, nil
}

func disableInstallationExtension(
	ctx context.Context,
	execer coredb.QueryExecer,
	workspaceID string,
	selectionID string,
	reason string,
	now time.Time,
) (InstallationExtension, error) {
	workspaceID = trim(workspaceID)
	selectionID = trim(selectionID)
	reason = trim(reason)
	if workspaceID == "" || selectionID == "" || reason == "" {
		return InstallationExtension{}, badRequest("workspaceId, Service Installation Extension id, and disabled reason are required")
	}
	now = now.UTC()
	if now.IsZero() {
		now = time.Now().UTC()
	}
	selection, found, err := loadInstallationExtensionByID(ctx, execer, selectionID, true)
	if err != nil {
		return InstallationExtension{}, err
	}
	if !found {
		return InstallationExtension{}, notFound("Service Installation Extension not found")
	}
	if selection.WorkspaceID != workspaceID {
		return InstallationExtension{}, conflict("Service Installation Extension does not belong to the requested Workspace.")
	}
	if err := validateInstallationExtensionHost(ctx, execer, selection, true); err != nil {
		return InstallationExtension{}, err
	}
	if selection.Status == StatusDisabled {
		return selection, nil
	}
	if _, err := execer.Exec(ctx, `
UPDATE service_installation_extensions
SET status = 'disabled',
    disabled_reason = $3,
    disabled_at = $4,
    updated_at = $4
WHERE id = $1
  AND workspace_id = $2
  AND status = 'active'
`, selectionID, workspaceID, reason, now); err != nil {
		return InstallationExtension{}, fmt.Errorf("disable Service Installation Extension: %w", err)
	}
	persisted, found, err := loadInstallationExtensionByID(ctx, execer, selectionID, false)
	if err != nil {
		return InstallationExtension{}, err
	}
	if !found {
		return InstallationExtension{}, notFound("Service Installation Extension not found")
	}
	return persisted, nil
}

func listInstallationExtensions(ctx context.Context, queryer coredb.Queryer, workspaceID string, serviceInstallationID string) ([]InstallationExtension, error) {
	workspaceID = trim(workspaceID)
	serviceInstallationID = trim(serviceInstallationID)
	if workspaceID == "" || serviceInstallationID == "" {
		return nil, badRequest("workspaceId and serviceInstallationId are required")
	}
	if err := validateAppInstallationIdentity(ctx, queryer, workspaceID, serviceInstallationID, false); err != nil {
		return nil, err
	}
	rows, err := queryer.Query(ctx, `
SELECT selection.id, selection.workspace_id, selection.service_definition_id,
       selection.service_installation_id, selection.extension_name,
       selection.definition_domain, selection.definition_version,
       selection.definition_digest, selection.status, selection.disabled_reason,
       selection.config, selection.selection_source, selection.created_by_member_id,
       selection.created_at, selection.updated_at, selection.disabled_at,
       COALESCE(definition.service_kind, ''),
       COALESCE(installation.workspace_id, ''),
       COALESCE(installation.service_definition_id, ''),
       COALESCE(installation.service_kind, ''),
       COALESCE(creator.workspace_id, ''),
       COALESCE(creator.type, '')
FROM service_installation_extensions selection
LEFT JOIN service_definitions definition
  ON definition.id = selection.service_definition_id
LEFT JOIN service_installations installation
  ON installation.id = selection.service_installation_id
LEFT JOIN members creator
  ON creator.id = selection.created_by_member_id
WHERE selection.service_installation_id = $1
ORDER BY selection.created_at ASC, selection.id ASC
`, serviceInstallationID)
	if err != nil {
		return nil, fmt.Errorf("list Service Installation Extensions: %w", err)
	}

	selections := make([]InstallationExtension, 0)
	for rows.Next() {
		selection, host, err := scanInstallationExtensionWithHost(rows)
		if err != nil {
			rows.Close()
			return nil, fmt.Errorf("scan Service Installation Extension: %w", err)
		}
		if selection.WorkspaceID != workspaceID || !installationExtensionHostMatches(selection, host) {
			rows.Close()
			return nil, conflict("Service Installation Extension host identity is inconsistent.")
		}
		selections = append(selections, selection)
	}
	if err := rows.Err(); err != nil {
		rows.Close()
		return nil, fmt.Errorf("iterate Service Installation Extensions: %w", err)
	}
	rows.Close()
	return selections, nil
}

func loadInstallationExtensionByID(ctx context.Context, queryer coredb.QueryRower, selectionID string, forUpdate bool) (InstallationExtension, bool, error) {
	query := installationExtensionSelectSQL() + ` WHERE id = $1`
	if forUpdate {
		query += ` FOR UPDATE`
	}
	selection, err := scanInstallationExtension(queryer.QueryRow(ctx, query, trim(selectionID)))
	if err != nil {
		if coredb.IsNotFound(err) {
			return InstallationExtension{}, false, nil
		}
		return InstallationExtension{}, false, fmt.Errorf("load Service Installation Extension by id: %w", err)
	}
	return selection, true, nil
}

func loadInstallationExtensionByDomainForUpdate(
	ctx context.Context,
	queryer coredb.QueryRower,
	serviceInstallationID string,
	definitionDomain string,
) (InstallationExtension, bool, error) {
	selection, err := scanInstallationExtension(queryer.QueryRow(ctx, installationExtensionSelectSQL()+`
WHERE service_installation_id = $1
  AND definition_domain = $2
FOR UPDATE
`, trim(serviceInstallationID), trim(definitionDomain)))
	if err != nil {
		if coredb.IsNotFound(err) {
			return InstallationExtension{}, false, nil
		}
		return InstallationExtension{}, false, fmt.Errorf("load Service Installation Extension by domain: %w", err)
	}
	return selection, true, nil
}

func loadActiveInstallationExtensionByNameForUpdate(
	ctx context.Context,
	queryer coredb.QueryRower,
	workspaceID string,
	extensionName string,
) (InstallationExtension, bool, error) {
	workspaceID = trim(workspaceID)
	extensionName = trim(extensionName)
	if workspaceID == "" || extensionName == "" {
		return InstallationExtension{}, false, badRequest("workspaceId and extensionName are required")
	}
	selection, err := scanInstallationExtension(queryer.QueryRow(ctx, installationExtensionSelectSQL()+`
WHERE workspace_id = $1
  AND active_extension_name = $2
FOR UPDATE
`, workspaceID, extensionName))
	if err != nil {
		if coredb.IsNotFound(err) {
			return InstallationExtension{}, false, nil
		}
		return InstallationExtension{}, false, fmt.Errorf("load active Service Installation Extension by name: %w", err)
	}
	return selection, true, nil
}

func validateInstallationExtensionHost(
	ctx context.Context,
	queryer coredb.QueryRower,
	selection InstallationExtension,
	forUpdate bool,
) error {
	query := `
SELECT definition.service_kind,
       installation.workspace_id,
       installation.service_definition_id,
       installation.service_kind,
       creator.workspace_id,
       creator.type
FROM service_definitions definition
JOIN service_installations installation
  ON installation.id = $2
JOIN members creator
  ON creator.id = $3
WHERE definition.id = $1`
	if forUpdate {
		query += ` FOR UPDATE`
	}
	var definitionKind string
	var installationWorkspaceID string
	var installationDefinitionID string
	var installationKind string
	var creatorWorkspaceID string
	var creatorType string
	err := queryer.QueryRow(
		ctx,
		query,
		trim(selection.ServiceDefinitionID),
		trim(selection.ServiceInstallationID),
		trim(selection.CreatedByMemberID),
	).Scan(
		&definitionKind,
		&installationWorkspaceID,
		&installationDefinitionID,
		&installationKind,
		&creatorWorkspaceID,
		&creatorType,
	)
	if err != nil {
		if coredb.IsNotFound(err) {
			return conflict("Service Installation Extension host identity is incomplete.")
		}
		return fmt.Errorf("validate Service Installation Extension host: %w", err)
	}
	if !installationExtensionHostMatches(selection, installationExtensionHost{
		definitionKind:           definitionKind,
		installationWorkspaceID:  installationWorkspaceID,
		installationDefinitionID: installationDefinitionID,
		installationKind:         installationKind,
		creatorWorkspaceID:       creatorWorkspaceID,
		creatorType:              creatorType,
	}) {
		return conflict("Service Installation Extension must belong to a matching App host and Human Workspace member.")
	}
	return nil
}

func validateAppInstallationIdentity(
	ctx context.Context,
	queryer coredb.QueryRower,
	workspaceID string,
	serviceInstallationID string,
	forUpdate bool,
) error {
	query := `
SELECT installation.workspace_id,
       installation.service_definition_id,
       installation.service_kind,
       definition.service_kind
FROM service_installations installation
JOIN service_definitions definition
  ON definition.id = installation.service_definition_id
WHERE installation.id = $1`
	if forUpdate {
		query += ` FOR UPDATE`
	}
	var persistedWorkspaceID string
	var definitionID string
	var installationKind string
	var definitionKind string
	err := queryer.QueryRow(ctx, query, trim(serviceInstallationID)).Scan(
		&persistedWorkspaceID,
		&definitionID,
		&installationKind,
		&definitionKind,
	)
	if err != nil {
		if coredb.IsNotFound(err) {
			return conflict("Service Installation Extension host Installation does not exist.")
		}
		return fmt.Errorf("validate App Installation identity: %w", err)
	}
	if trim(persistedWorkspaceID) != trim(workspaceID) ||
		trim(definitionID) == "" ||
		trim(installationKind) != KindApp ||
		trim(definitionKind) != KindApp {
		return conflict("Service Installation Extension host must be a matching App Installation.")
	}
	return nil
}

func normalizeInstallationExtensionUpsert(params InstallationExtensionUpsert) (InstallationExtension, time.Time, error) {
	selection := params.InstallationExtension
	selection.ID = trim(selection.ID)
	selection.WorkspaceID = trim(selection.WorkspaceID)
	selection.ServiceDefinitionID = trim(selection.ServiceDefinitionID)
	selection.ServiceInstallationID = trim(selection.ServiceInstallationID)
	selection.ExtensionName = trim(selection.ExtensionName)
	selection.DefinitionDomain = trim(selection.DefinitionDomain)
	selection.DefinitionDigest = trim(selection.DefinitionDigest)
	selection.Status = trim(selection.Status)
	selection.DisabledReason = trim(selection.DisabledReason)
	selection.SelectionSource = trim(selection.SelectionSource)
	selection.CreatedByMemberID = trim(selection.CreatedByMemberID)
	if selection.ID == "" ||
		selection.WorkspaceID == "" ||
		selection.ServiceDefinitionID == "" ||
		selection.ServiceInstallationID == "" ||
		selection.ExtensionName == "" ||
		selection.DefinitionDomain == "" ||
		selection.CreatedByMemberID == "" {
		return InstallationExtension{}, time.Time{}, badRequest("Service Installation Extension identity, host, name, domain, and creator are required")
	}
	if len(selection.ExtensionName) > 255 || !installationExtensionNamePattern.MatchString(selection.ExtensionName) {
		return InstallationExtension{}, time.Time{}, badRequest("Extension name must be lowercase kebab-case")
	}
	if selection.DefinitionVersion <= 0 || !installationExtensionDigestPattern.MatchString(selection.DefinitionDigest) {
		return InstallationExtension{}, time.Time{}, badRequest("Extension definition version and digest are invalid")
	}
	if len(selection.Config) > 0 && !model.IsValidJSON(selection.Config) {
		return InstallationExtension{}, time.Time{}, badRequest("Service Installation Extension config must be valid JSON")
	}
	if selection.Status == "" {
		selection.Status = StatusActive
	}
	switch selection.Status {
	case StatusActive:
		selection.DisabledReason = ""
		selection.DisabledAt = nil
	case StatusDisabled:
		if selection.DisabledReason == "" {
			return InstallationExtension{}, time.Time{}, badRequest("Disabled Service Installation Extensions require a reason")
		}
	default:
		return InstallationExtension{}, time.Time{}, badRequest("Service Installation Extension status is invalid")
	}
	switch selection.SelectionSource {
	case InstallationExtensionSourceAppDefault, InstallationExtensionSourceUser:
	default:
		return InstallationExtension{}, time.Time{}, badRequest("Service Installation Extension selection source is invalid")
	}
	now := params.Now.UTC()
	if now.IsZero() {
		now = time.Now().UTC()
	}
	if selection.Status == StatusDisabled {
		selection.DisabledAt = &now
	}
	return selection, now, nil
}

func installationExtensionIdentityMatches(left InstallationExtension, right InstallationExtension) bool {
	return left.ID == right.ID &&
		left.WorkspaceID == right.WorkspaceID &&
		left.ServiceDefinitionID == right.ServiceDefinitionID &&
		left.ServiceInstallationID == right.ServiceInstallationID &&
		left.DefinitionDomain == right.DefinitionDomain &&
		left.CreatedByMemberID == right.CreatedByMemberID
}

func installationExtensionSelectSQL() string {
	return `
SELECT id, workspace_id, service_definition_id, service_installation_id,
       extension_name, definition_domain, definition_version, definition_digest,
       status, disabled_reason, config, selection_source, created_by_member_id,
       created_at, updated_at, disabled_at
FROM service_installation_extensions`
}

func scanInstallationExtension(row coredb.Row) (InstallationExtension, error) {
	var selection InstallationExtension
	var disabledAt sql.NullTime
	if err := row.Scan(installationExtensionScanDestinations(&selection, &disabledAt)...); err != nil {
		return InstallationExtension{}, err
	}
	normalizeScannedInstallationExtension(&selection, disabledAt)
	return selection, nil
}

type installationExtensionHost struct {
	definitionKind           string
	installationWorkspaceID  string
	installationDefinitionID string
	installationKind         string
	creatorWorkspaceID       string
	creatorType              string
}

func scanInstallationExtensionWithHost(row coredb.Row) (InstallationExtension, installationExtensionHost, error) {
	var selection InstallationExtension
	var disabledAt sql.NullTime
	var host installationExtensionHost
	destinations := installationExtensionScanDestinations(&selection, &disabledAt)
	destinations = append(
		destinations,
		&host.definitionKind,
		&host.installationWorkspaceID,
		&host.installationDefinitionID,
		&host.installationKind,
		&host.creatorWorkspaceID,
		&host.creatorType,
	)
	if err := row.Scan(destinations...); err != nil {
		return InstallationExtension{}, installationExtensionHost{}, err
	}
	normalizeScannedInstallationExtension(&selection, disabledAt)
	return selection, host, nil
}

func installationExtensionScanDestinations(selection *InstallationExtension, disabledAt *sql.NullTime) []any {
	return []any{
		&selection.ID,
		&selection.WorkspaceID,
		&selection.ServiceDefinitionID,
		&selection.ServiceInstallationID,
		&selection.ExtensionName,
		&selection.DefinitionDomain,
		&selection.DefinitionVersion,
		&selection.DefinitionDigest,
		&selection.Status,
		&selection.DisabledReason,
		&selection.Config,
		&selection.SelectionSource,
		&selection.CreatedByMemberID,
		&selection.CreatedAt,
		&selection.UpdatedAt,
		disabledAt,
	}
}

func normalizeScannedInstallationExtension(selection *InstallationExtension, disabledAt sql.NullTime) {
	selection.ID = trim(selection.ID)
	selection.WorkspaceID = trim(selection.WorkspaceID)
	selection.ServiceDefinitionID = trim(selection.ServiceDefinitionID)
	selection.ServiceInstallationID = trim(selection.ServiceInstallationID)
	selection.ExtensionName = trim(selection.ExtensionName)
	selection.DefinitionDomain = trim(selection.DefinitionDomain)
	selection.DefinitionDigest = trim(selection.DefinitionDigest)
	selection.Status = trim(selection.Status)
	selection.DisabledReason = trim(selection.DisabledReason)
	selection.SelectionSource = trim(selection.SelectionSource)
	selection.CreatedByMemberID = trim(selection.CreatedByMemberID)
	selection.DisabledAt = ptrFromNullTime(disabledAt)
}

func installationExtensionHostMatches(selection InstallationExtension, host installationExtensionHost) bool {
	return trim(host.definitionKind) == KindApp &&
		trim(host.installationKind) == KindApp &&
		trim(host.installationWorkspaceID) == selection.WorkspaceID &&
		trim(host.installationDefinitionID) == selection.ServiceDefinitionID &&
		trim(host.creatorWorkspaceID) == selection.WorkspaceID &&
		trim(host.creatorType) == "human"
}

func mapInstallationExtensionWriteError(err error) error {
	if constraint, ok := coredb.UniqueViolationConstraint(err); ok {
		switch constraint {
		case "PRIMARY":
			return conflict("Service Installation Extension id already exists.")
		case "service_installation_extensions_installation_domain_key":
			return conflict("Extension domain is already selected for this Service Installation.")
		case "service_installation_extensions_workspace_active_name_key":
			return conflict("Extension name is already active in this Workspace.")
		}
	}
	return err
}