package mcpsrv

import (
	"errors"
	"log/slog"

	"github.com/modelcontextprotocol/go-sdk/jsonrpc"
	"go.bigb.es/auxilia/scribe"

	"sourcecraft.dev/bigbes/sr-ht-spec/core"
	"sourcecraft.dev/bigbes/sr-ht-spec/service"
)

// The one place this surface decides what a failure *is*, which on MCP is a
// question with two answers rather than a status code.
//
//   - A tool result error (CallToolResult.IsError) is an answer to the agent:
//     the call was understood, executed, and the thing asked for is not there.
//     The SDK produces one out of any ordinary error a handler returns, and the
//     agent reads it as text and decides what to ask next.
//   - A protocol error (a *jsonrpc.Error returned by a handler, which the SDK
//     passes through as the JSON-RPC error of the response) says the call did
//     not produce an answer at all. The client's CallTool returns an error
//     rather than a result, which is exactly right for a git object store that
//     is down: an agent must not read "the store could not answer" as "that
//     document does not exist" and go rewrite a specification around a document
//     that is perfectly real.
//
// Before this file the two were one. Every error from below travelled to the
// agent as a tool result carrying its own text, so `git object store is on
// fire` and `no document "SPEC-0007"` were the same kind of answer, told apart
// only by prose the agent would have had to parse. The tests pinned it: a
// backend failure asserted that the agent was shown the words "on fire".
//
// The whole table is missingOrDenied plus a default, and the default is the
// protocol arm on purpose: an unmapped error is a bug in a layer below, and
// rendering it as a tool result would report that bug to the agent as a fact
// about the corpus.

// internalMessage is the message of every protocol error this surface returns.
// The detail is logged, never sent: the errors below name spaces, revisions,
// paths and git internals, and an agent holding a working token is not the
// audience for any of it.
const internalMessage = "internal server error"

// missingOrDenied is the answer to a read that resolved to nothing.
//
// missing is the sentence the agent sees, and every caller builds it from the
// arguments of the call being answered ("no space ~alice/rfcs"). That is
// deliberate: the sentence is written from what the caller passed, so it
// discloses nothing the caller did not already know, and it does not carry the
// wrapped text of the error it is replacing — service/ wraps its misses with
// what it looked up, and echoing that is how a surface eventually publishes the
// difference between "no such space" and "not yours".
//
// where is the operator's half — the tool name — and appears only in the log
// line of the protocol arm.
func missingOrDenied(err error, where, missing string) error {
	if errors.Is(err, service.ErrNotFound) {
		// A tool result error: the SDK packs an ordinary error into
		// CallToolResult with IsError set.
		return errors.New(missing)
	}
	return internalError(err, where)
}

// internalError logs the cause and returns the protocol error the client sees.
//
// The error goes through scribe.Err, which expands a culpa chain into err.msg,
// err.code and err.hint instead of flattening it with %v.
func internalError(err error, where string) error {
	slog.Error("a tool call failed", "tool", where, scribe.Err(err))
	return &jsonrpc.Error{Code: jsonrpc.CodeInternalError, Message: internalMessage}
}

// noSpace and noRevision are the two "missing" sentences the read tools pass to
// missingOrDenied, built from the call's own arguments and nothing else.
//
// There is no masked-versus-absent distinction to preserve here, unlike the
// sibling services: Gate has already established that the caller is the owner
// or one of its agents, and this is a single-user instance whose spaces all
// belong to that owner. A space this caller cannot see does not exist.
func noSpace(ref core.SpaceRef) string { return "no space " + ref.String() }

func noRevision(ref core.SpaceRef, rev string) string {
	if rev == service.ApprovedRev {
		return "space " + ref.String() + " has no approved revision to read"
	}
	return "no revision " + rev + " in " + ref.String()
}