package gudusoft.gsqlparser;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;

/**
 * Trial-build input size gate, measured ONCE, at the place the SQL is read.
 *
 * <h2>The rule</h2>
 *
 * <ul>
 *   <li>A byte-backed source (file, stream, FIFO, socket) is measured in RAW
 *       BYTES, before any decoding: at most {@code TBaseType.trialSizeLimitBytes()}
 *       bytes.</li>
 *   <li>A {@code String} input has no wire format, so it is measured in
 *       CHARACTERS, ignoring leading whitespace: at most the same limit.</li>
 * </ul>
 *
 * <h2>Why characters for Strings, and why this needs no exemption machinery</h2>
 *
 * The parser re-parses its own already-ingested text in many places -- routine
 * bodies, dynamic SQL, vendor retries; a survey found 73 such sub-parser sites.
 * Those re-parses hand a {@code String} to a fresh parser, which measures it
 * again. Every earlier revision of this gate therefore needed a way to tell
 * "caller ingestion" from "internal re-parse" (explicit marks, then a
 * ThreadLocal parse depth), and every such mechanism was itself a source of
 * defects: a missed mark refused a valid 8,118-byte DB2 procedure; a
 * UTF-16 function accepted at 6,968 raw bytes had its 10,283-UTF-8-byte body
 * silently dropped.
 *
 * <p>Measuring Strings in characters removes the problem instead of managing
 * it. Every charset encodes a character in at least one byte, so an input
 * accepted under the byte cap has at most {@code limit} characters -- and any
 * substring of it fewer still. Every internal re-parse of ingested text
 * therefore passes arithmetically, with no marks, no thread state, and no list
 * of sites to keep complete. Leading whitespace is ignored because internal
 * re-parses prepend newlines/spaces to preserve the original line/column
 * coordinates ({@code TBaseType.stringBlock}), and that padding is not input.
 *
 * <p>The tolerated cost runs in the harmless direction only: a caller-supplied
 * String of multi-byte characters (e.g. 10,000 CJK characters, ~30KB as UTF-8)
 * is accepted in a trial build. An oversized input slipping through a trial
 * gate is a far smaller cost than a valid input being refused and its parse
 * silently lost (owner decision 2026-07-28).
 *
 * <h2>Why raw bytes for byte-backed sources</h2>
 *
 * The cap used to be enforced by re-encoding already-decoded characters -- per
 * line inside the lexer, per token inside the raw-statement extractor. That is
 * not what "bytes" means, and it produced a fresh defect of the same family in
 * every revision: a byte-order mark charged once per line inflated a valid
 * 9,602-byte UTF-16 script to 10,080 and refused it; stateful ISO-2022
 * encodings over-counted; charsets that can decode but not encode threw
 * {@code UnsupportedOperationException}; a BOM stripped before counting let a
 * 10,001-byte stream through; a cached lexer kept the previous input's charset
 * and refused a valid 6,000-byte ASCII input. All of those are the same
 * mistake. This class measures a byte source as it actually exists -- bytes,
 * before any decoding -- so none of them can recur.
 *
 * <h2>Contract</h2>
 *
 * <ul>
 *   <li>A byte-backed source is read once into a bounded snapshot of at most
 *       {@code cap + 1} bytes. Reaching {@code cap + 1} means the input is over
 *       the cap and is refused; otherwise the snapshot IS the whole input and
 *       downstream consumes it, so the source is never read twice.</li>
 *   <li>An {@link IOException} while measuring is reported as an I/O failure,
 *       never as an accepted short input. A partial read that then fails must
 *       not look like a small legal input.</li>
 * </ul>
 *
 * <p>Every method is a no-op in full builds, where {@code TBaseType.full_edition}
 * is a compile-time constant and the guarded blocks are removed entirely.
 */
public final class TrialInputGuard {

    private TrialInputGuard() {
    }

    /**
     * Outcome of measuring one input: allowed (optionally carrying the snapshot
     * that downstream must consume in place of the original source), refused, or
     * failed with I/O.
     */
    public static final class Result {
        private static final Result ALLOWED_NO_SNAPSHOT = new Result(null, null, null);

        private final byte[] snapshot;
        private final String refusalMessage;
        private final IOException ioFailure;

        private Result(byte[] snapshot, String refusalMessage, IOException ioFailure) {
            this.snapshot = snapshot;
            this.refusalMessage = refusalMessage;
            this.ioFailure = ioFailure;
        }

        public boolean isRefused() {
            return refusalMessage != null;
        }

        public boolean isIoFailure() {
            return ioFailure != null;
        }

        /** Canonical cap message; null unless {@link #isRefused()}. */
        public String getRefusalMessage() {
            return refusalMessage;
        }

        public IOException getIoFailure() {
            return ioFailure;
        }

        /**
         * Bytes already consumed from the source, which downstream MUST use in
         * place of the original stream (the source has been read to EOF). Null
         * when there is nothing to replace -- full builds, String input, or a
         * refusal.
         */
        public byte[] getSnapshot() {
            return snapshot;
        }
    }

    /**
     * Measure a {@code String} input in characters, ignoring leading
     * whitespace. Returns refused when the count exceeds the cap. Never
     * consumes anything, and never re-encodes: characters, not bytes, are what
     * keep internal re-parses of already-ingested text inside the cap (see the
     * class comment).
     */
    public static Result checkText(String sqlText) {
        if (TBaseType.full_edition || sqlText == null || sqlText.isEmpty()) {
            return Result.ALLOWED_NO_SNAPSHOT;
        }
        int start = 0;
        while (start < sqlText.length() && Character.isWhitespace(sqlText.charAt(start))) {
            start++;
        }
        if (TBaseType.trialSizeExceeded(sqlText.length() - start)) {
            return new Result(null, TBaseType.trialSizeMessage(), null);
        }
        return Result.ALLOWED_NO_SNAPSHOT;
    }

    /**
     * Measure a byte-backed source by reading at most {@code cap + 1} bytes.
     *
     * <p>On success the returned snapshot holds the ENTIRE input and the caller
     * must use it instead of {@code source}, which is now at EOF. File length is
     * deliberately NOT consulted: a file can change between a stat and a read,
     * and reading the same stream that feeds decoding removes that race along
     * with any disagreement between the two.
     */
    public static Result checkStream(InputStream source) {
        if (TBaseType.full_edition || source == null) {
            return Result.ALLOWED_NO_SNAPSHOT;
        }
        int limit = TBaseType.trialSizeLimitBytes();
        ByteArrayOutputStream captured = new ByteArrayOutputStream(Math.min(limit + 1, 16384));
        byte[] chunk = new byte[4096];
        int total = 0;
        try {
            while (total <= limit) {
                int want = Math.min(chunk.length, limit + 1 - total);
                int read = source.read(chunk, 0, want);
                if (read == -1) break;
                captured.write(chunk, 0, read);
                total += read;
            }
        } catch (IOException e) {
            // A partial read that then failed is NOT a small legal input.
            return new Result(null, null, e);
        }
        if (total > limit) {
            return new Result(null, TBaseType.trialSizeMessage(), null);
        }
        return new Result(captured.toByteArray(), null, null);
    }

    /**
     * Measure caller-supplied token text -- the one input with no source to read,
     * reachable through {@code doExtractRawStatements}. Counted in characters
     * like any other String input; the running total lets a huge token list
     * fail fast without joining it.
     */
    public static boolean tokenTextExceedsCap(TSourceTokenList tokens) {
        if (TBaseType.full_edition || tokens == null) {
            return false;
        }
        int limit = TBaseType.trialSizeLimitBytes();
        long total = 0;
        for (int i = 0; i < tokens.size(); i++) {
            TSourceToken st = tokens.get(i);
            if (st == null) continue;
            String text = st.getAstext();
            if (text == null) continue;
            total += text.length();
            if (total > limit) {
                return true;
            }
        }
        return false;
    }
}