package publicerror

import (
	"net/http"
	"strings"
	"testing"
)

func TestTransportErrorsNeverExposeSocketDetails(t *testing.T) {
	raw := "read tcp 10.42.0.72:54960->47.77.191.126:443: read: connection reset by peer"
	got := FromFields("response_read_error", raw, http.StatusOK, true)
	if got.Code != "upstream_connection_interrupted" || got.HTTPStatus != http.StatusBadGateway || !got.Retryable {
		t.Fatalf("unexpected public error: %+v", got)
	}
	if strings.Contains(got.Message, "10.42.0.72") || strings.Contains(got.Message, "47.77.191.126") {
		t.Fatalf("public error leaked socket details: %+v", got)
	}
}

func TestStorageAndExpiredErrorsHaveStableActions(t *testing.T) {
	storage := FromFields("storage_write_failed", "secret endpoint", 0, true)
	if storage.Category != "storage" || storage.Action != "retry" || storage.HTTPStatus != http.StatusServiceUnavailable {
		t.Fatalf("unexpected storage error: %+v", storage)
	}
	expired := FromFields("binary_result_expired", "local binary result has expired", 0, false)
	if expired.Code != "result_expired" || expired.Action != "resubmit" || expired.HTTPStatus != http.StatusGone {
		t.Fatalf("unexpected expired error: %+v", expired)
	}
}

func TestUnknownServerErrorDoesNotExposeProviderBody(t *testing.T) {
	raw := `provider rejected request: {"account":"secret-project","detail":"internal"}`
	got := FromFields("vendor_opaque_error", raw, http.StatusBadGateway, true)
	if got.Code != "gateway_error" || got.Message == raw || strings.Contains(got.Message, "secret-project") {
		t.Fatalf("unknown provider error was exposed: %+v", got)
	}
}

func TestProviderHTTPErrorDoesNotExposeProviderBody(t *testing.T) {
	raw := `{"error":{"message":"bucket private-a rejected secret-project"}}`
	for _, test := range []struct {
		code       string
		status     int
		wantCode   string
		wantStatus int
	}{
		{code: "http_400", status: http.StatusBadRequest, wantCode: "upstream_request_rejected", wantStatus: http.StatusBadRequest},
		{code: "auth_failed", status: http.StatusUnauthorized, wantCode: "upstream_auth_failed", wantStatus: http.StatusBadGateway},
		{code: "provider_failed", status: http.StatusForbidden, wantCode: "upstream_auth_failed", wantStatus: http.StatusBadGateway},
		{code: "provider_failed", status: http.StatusTooManyRequests, wantCode: "upstream_rate_limited", wantStatus: http.StatusTooManyRequests},
		{code: "server_error", status: http.StatusBadGateway, wantCode: "upstream_unavailable", wantStatus: http.StatusServiceUnavailable},
		{code: "invalid_response", status: http.StatusOK, wantCode: "upstream_invalid_response", wantStatus: http.StatusBadGateway},
	} {
		got := FromFields(test.code, raw, test.status, true)
		if got.Code != test.wantCode || got.HTTPStatus != test.wantStatus {
			t.Fatalf("%s: unexpected public error: %+v", test.code, got)
		}
		if strings.Contains(got.Message, "private-a") || strings.Contains(got.Message, "secret-project") {
			t.Fatalf("%s: provider body leaked: %+v", test.code, got)
		}
	}
}

func TestValidationGateKeepsStablePublicCode(t *testing.T) {
	got := FromFields("validation_in_progress", "new production tasks are paused while validation is running", http.StatusServiceUnavailable, true)
	if got.Code != "validation_in_progress" || got.HTTPStatus != http.StatusServiceUnavailable || !got.Retryable {
		t.Fatalf("unexpected validation gate error: %+v", got)
	}
}