// file: crates/ksp-app-store-desk/unit_tests/dto_common.rs
// version: 2

#[test]
fn command_error_projection_keeps_only_stable_public_fields() {
    let source = ksp_core_lib::Error::new(crate::ERROR_CODE_APP_STATE_INVALID, "safe message").with_context("secret_context", "must-not-cross-ipc");
    let projected = crate::CommandErrorDto::from_error(&source);
    assert_eq!(projected.domain, "store_desk");
    assert_eq!(projected.code, "app_state_invalid");
    assert_eq!(projected.message, "safe message");
    let debug = format!("{projected:?}");
    assert!(!debug.contains("must-not-cross-ipc"));
}

#[test]
fn store_runtime_status_dto_contains_only_safe_portable_fields() {
    let value = crate::StoreRuntimeStatusDto {
        backend_kind: std::option::Option::Some("postgres".to_owned()),
        diagnostic: std::option::Option::None,
        health_state: "ready".to_owned(),
        migration_version_decimal: std::option::Option::Some("2".to_owned()),
        network: std::option::Option::Some("mainnet-beta".to_owned()),
        pending_migration_count: 0,
        pool_available: 1,
        pool_capacity: 8,
        pool_size: 1,
        pool_waiting: 0,
        profile_id: std::option::Option::Some("mainnet".to_owned()),
        store_open: true,
    };
    let serialized = serde_json::to_string(&value);
    assert!(serialized.is_ok(), "safe Store runtime DTO must serialize: {serialized:?}");
    if let std::result::Result::Ok(serialized) = serialized {
        assert!(serialized.contains("\"backendKind\":\"postgres\""));
        assert!(serialized.contains("\"migrationVersionDecimal\":\"2\""));
        for forbidden in ["postgresql://", "connection_uri", "connectionUri", "password", "payload", "dataBytes"] {
            assert!(!serialized.contains(forbidden), "Store runtime DTO leaked forbidden material: {forbidden}");
        }
    }
}