liminal-server 0.25.4

use super::{ChannelAccessError, ChannelConfigField, ChannelRegistryError};
use liminal_protocol::reason_code::{
    CHANNEL_NOT_REGISTERED_CODE, CHANNEL_QUIESCED_CODE, CONSOLE_NAMESPACE_REFUSED_CODE,
    CONSOLE_TAP_LIMIT_REFUSED_CODE, CONSOLE_TAP_TARGET_REFUSED_CODE,
};

/// The typed refusals carry the reserved server-band codes, and the internal
/// fault carries the undifferentiated one. Pinned against the protocol crate's
/// consts (not against literals) on two of the three, and against the literal
/// `0xFFFF` on the third — which is the value the band map records and this
/// module re-declares.
#[test]
fn access_refusals_carry_their_reserved_reason_codes() {
    assert_eq!(
        ChannelAccessError::NotRegistered {
            name: "orders".to_owned()
        }
        .reason_code(),
        CHANNEL_NOT_REGISTERED_CODE
    );
    assert_eq!(
        ChannelAccessError::Quiesced {
            name: "orders".to_owned(),
            reason: "archived".to_owned()
        }
        .reason_code(),
        CHANNEL_QUIESCED_CODE
    );
    assert_eq!(
        ChannelAccessError::RosterUnavailable {
            message: "poisoned".to_owned()
        }
        .reason_code(),
        0xFFFF
    );
}

/// The two roster codes are DIFFERENT from each other and from the
/// undifferentiated one: a client that branches on the code must be able to tell
/// "no such channel" from "quiesced" from "something else went wrong".
#[test]
fn the_three_access_codes_are_mutually_distinct() {
    let absent = ChannelAccessError::NotRegistered {
        name: "orders".to_owned(),
    }
    .reason_code();
    let quiesced = ChannelAccessError::Quiesced {
        name: "orders".to_owned(),
        reason: "archived".to_owned(),
    }
    .reason_code();
    let fault = ChannelAccessError::RosterUnavailable {
        message: "poisoned".to_owned(),
    }
    .reason_code();
    assert_ne!(absent, quiesced);
    assert_ne!(absent, fault);
    assert_ne!(quiesced, fault);
}

/// The console namespace refusal carries its own code, distinct from both
/// roster codes and from the undifferentiated one: the channel may be
/// registered and admitting, and a client must be able to tell "not yours to
/// write" from "not there" and from "something else went wrong".
#[test]
fn the_console_namespace_refusal_carries_its_own_code() {
    let refused = ChannelAccessError::ConsoleNamespace {
        name: "console.topology".to_owned(),
    }
    .reason_code();
    assert_eq!(refused, CONSOLE_NAMESPACE_REFUSED_CODE);
    for other in [CHANNEL_NOT_REGISTERED_CODE, CHANNEL_QUIESCED_CODE, 0xFFFF] {
        assert_ne!(refused, other);
    }
}

/// The two tap refusals carry their own codes.
#[test]
fn the_tap_refusals_carry_their_own_codes() {
    assert_eq!(
        ChannelAccessError::ConsoleTapTarget {
            name: "console.tap.".to_owned(),
        }
        .reason_code(),
        CONSOLE_TAP_TARGET_REFUSED_CODE
    );
    assert_eq!(
        ChannelAccessError::ConsoleTapLimit {
            name: "console.tap.orders".to_owned(),
            limit: 256,
        }
        .reason_code(),
        CONSOLE_TAP_LIMIT_REFUSED_CODE
    );
}

/// A tap subject's target is what follows `console.tap.`, empty included.
#[test]
fn a_tap_subject_names_its_target() {
    assert_eq!(
        super::console_tap_target("console.tap.orders"),
        Some("orders")
    );
    assert_eq!(super::console_tap_target("console.tap."), Some(""));
    assert_eq!(super::console_tap_target("console.topology"), None);
    assert_eq!(super::console_tap_target("orders"), None);
}

/// Exactly the `console.` prefix is the server's: a subject that only
/// resembles it is an ordinary channel.
#[test]
fn only_the_console_prefix_is_the_servers_namespace() {
    for subject in ["console.topology", "console.tap.orders", "console."] {
        assert!(super::is_console_subject(subject), "{subject}");
    }
    for subject in [
        "console",
        "consoles.topology",
        "orders.console.x",
        "Console.topology",
        "",
    ] {
        assert!(!super::is_console_subject(subject), "{subject}");
    }
}

/// The mismatch field renders as prose inside the refusal, so an operator reads
/// which field differed while a program branches on the variant.
#[test]
fn already_registered_names_the_differing_field() {
    for (field, rendered) in [
        (ChannelConfigField::Mode, "mode"),
        (ChannelConfigField::SchemaId, "schema id"),
        (ChannelConfigField::SchemaDocument, "schema document"),
    ] {
        let error = ChannelRegistryError::AlreadyRegistered {
            name: "orders".to_owned(),
            field,
        };
        assert_eq!(
            error.to_string(),
            format!("channel 'orders' is already registered with a different {rendered}")
        );
    }
}

/// The cap refusals name the config key, so an operator is told what to declare
/// rather than that something is missing.
#[test]
fn cap_refusals_name_the_config_key() {
    let absent = ChannelRegistryError::CapNotConfigured {
        cap: super::MAX_CHANNELS_KEY,
    };
    assert!(absent.to_string().contains("limits.max_channels"));
    let reached = ChannelRegistryError::CapReached {
        cap: super::MAX_CHANNELS_KEY,
        limit: 4,
    };
    assert_eq!(
        reached.to_string(),
        "channel registration refused: the limits.max_channels limit of 4 is reached"
    );
}