"""A certificate POST conflict is not proof of quota exhaustion."""
from __future__ import annotations

import json

_CODES = frozenset({"ENTITY_ERROR", "ENTITY_ERROR.ATTRIBUTE.INVALID", "ENTITY_ERROR.ATTRIBUTE.REQUIRED",
                    "ENTITY_ERROR.RELATIONSHIP.INVALID", "ENTITY_ERROR.RELATIONSHIP.REQUIRED",
                    "STATE_ERROR", "FORBIDDEN_ERROR", "UNEXPECTED_ERROR"})
_CAP_DETAILS = (
    "maximum number of certificates",
    "maximum allowed number of certificates",
    "you already have a current distribution certificate or a pending certificate request",
    "certificate limit has been reached",
    "certificate limit reached",
)


def conflict(response) -> dict:
    """Use fixed labels and code allowlists; never return provider text, URLs or CSR data."""
    try:
        payload = response.json()
    except (ValueError, TypeError):
        payload = {}
    errors = payload.get("errors", []) if isinstance(payload, dict) else []
    errors = errors[:32] if isinstance(errors, list) else []
    codes, capped = set(), False
    for error in errors:
        if not isinstance(error, dict):
            continue
        code = error.get("code")
        if isinstance(code, str) and code in _CODES:
            codes.add(code)
        detail = error.get("detail")
        if isinstance(detail, str):
            capped |= any(marker in detail[:8192].lower() for marker in _CAP_DETAILS)
    return {"schema": "gowalk-cicd/apple-certificate-rejected.v1", "operation": "certificates_createInstance",
            "http_status": 409, "reason": "certificate_limit" if capped else "unclassified_conflict",
            "error_codes": sorted(codes)}


def refuse(response) -> None:
    result = conflict(response)
    print("::error title=apple_certificate_rejected::" + json.dumps(result, separators=(",", ":")))
    raise SystemExit(
        f"Apple certificate request rejected (HTTP 409; reason={result['reason']}); "
        "policy=fail preserves all existing certificates and refuses automatic revocation"
    )