package core

import (
	"fmt"
	"strconv"
)

// ProposalPrefix is the ref namespace a proposal branch lives under, and the
// only namespace an agent credential may write. The refs rule — an agent token
// can only update refs under this prefix, and only the owner can move the
// approved branch — is the boundary that actually bounds the damage a confused
// agent can do.
//
// It lives here rather than in gitx or db because both derive branch names from
// it and a proposal whose row and whose ref disagree about its name is a break
// with no cheap way to trace it.
const ProposalPrefix = "proposals/"

// ProposalBranch is the branch name for a proposal id: "proposals/42". The id
// is the proposal row's primary key, which is what the branch, the row and the
// stable proposal URL share — so this is the one derivation, and gitx and db
// both call it rather than each spelling the concatenation out.
//
// A non-positive id is refused rather than formatted: ids come from a Postgres
// sequence and start at 1, so a zero is an unwritten row or an unset field, and
// "proposals/0" is a branch name that would go on to be created, pushed and
// looked for.
func ProposalBranch(id int64) (string, error) {
	if id <= 0 {
		return "", fmt.Errorf("%w: proposal id %d must be positive", ErrInvalidProposalID, id)
	}
	return ProposalPrefix + strconv.FormatInt(id, 10), nil
}

// ProposalState is the lifecycle of a proposal.
//
//	open ──► merged
//	  └───► rejected
//
// Collapsed from the usual five-state machine because there is exactly one
// reviewer: with nobody else in the loop, "approve" is "merge now", and there
// is no one to request changes from — a proposal you dislike is rejected and
// the agent proposes again. Keeping `approved` and `merged` apart, or a
// `changes-requested` cycle, would be machinery serving a review conversation
// that has no second party.
type ProposalState string

const (
	StateOpen     ProposalState = "open"
	StateMerged   ProposalState = "merged"
	StateRejected ProposalState = "rejected"
)

// ProposalStates returns every state, in lifecycle order.
func ProposalStates() []ProposalState {
	return []ProposalState{StateOpen, StateMerged, StateRejected}
}

// ParseProposalState validates a state string, typically one read back from
// Postgres or an API request.
func ParseProposalState(s string) (ProposalState, error) {
	switch ProposalState(s) {
	case StateOpen, StateMerged, StateRejected:
		return ProposalState(s), nil
	}
	return "", fmt.Errorf("%w: %q is not one of open|merged|rejected", ErrInvalidState, s)
}

// Terminal reports whether the proposal has been resolved. Terminal proposals
// keep their URL — a link still resolves after merge or rejection, showing the
// outcome — but they never move again.
func (s ProposalState) Terminal() bool {
	return s == StateMerged || s == StateRejected
}

// CanTransitionTo reports whether the proposal may move from s to next,
// returning ErrInvalidTransition with both states named if it may not.
//
// Only open→merged and open→rejected are legal. Self-transitions are rejected
// too: the reconciler repairs a crashed merge by comparing the ref against the
// row and only writing when they differ, so a "merged→merged" call is a bug in
// the caller rather than an idempotent retry.
func (s ProposalState) CanTransitionTo(next ProposalState) error {
	if _, err := ParseProposalState(string(s)); err != nil {
		return err
	}
	if _, err := ParseProposalState(string(next)); err != nil {
		return err
	}
	if !ValidTransition(s, next) {
		return fmt.Errorf("%w: %s -> %s", ErrInvalidTransition, s, next)
	}
	return nil
}

// ValidTransition is the transition table itself.
func ValidTransition(from, to ProposalState) bool {
	return from == StateOpen && (to == StateMerged || to == StateRejected)
}

// Approval records how a merge was authorized, and is set on merge.
//
// Auto-merged is not human-approved, and readers must be able to tell: a bot
// asking for the approved text of a spec should be able to require human
// approval and get a different answer than for a firehose note. Collapsing the
// two would quietly launder unreviewed agent output as blessed.
type Approval string

const (
	// ApprovalHuman means the owner clicked approve.
	ApprovalHuman Approval = "human"
	// ApprovalPolicy means the path matched the space's auto_merge patterns.
	ApprovalPolicy Approval = "policy"
)

// ParseApproval validates an approval kind read back from Postgres or an API.
func ParseApproval(s string) (Approval, error) {
	switch Approval(s) {
	case ApprovalHuman, ApprovalPolicy:
		return Approval(s), nil
	}
	return "", fmt.Errorf("%w: %q is not one of human|policy", ErrInvalidApproval, s)
}