import { ReviewValidationError } from './errors.js'

/**
 * Canonical review-id (UUID) shape — the single source of truth for the
 * `reviewId` / cursor-id trust boundary. `review.id` is a Postgres `uuid`
 * column; passing a non-uuid value into `eq(review.id, …)` makes Postgres
 * raise `invalid input syntax for type uuid` — a RAW DB error (info-leak) and
 * a non-uniform throw that breaks the no-oracle property. Every public entry
 * point that takes an untrusted review id MUST funnel it through
 * `assertReviewId` first (D9), exactly as the list cursor does (D8).
 */
export const REVIEW_ID_RE =
  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i

/**
 * Validate an untrusted `reviewId` at the trust boundary.
 * Malformed (non-uuid, empty, oversized) → typed `ReviewValidationError`,
 * never a raw DB throw. Returns nothing; throws on invalid input.
 */
export function assertReviewId(reviewId: string): void {
  if (typeof reviewId !== 'string' || !REVIEW_ID_RE.test(reviewId)) {
    throw new ReviewValidationError('reviewId')
  }
}