loader_validate_validator.go

// SPDX-License-Identifier: AGPL-3.0-or-later
// SPDX-FileCopyrightText: 2026 Mohammad Mahdi Baghbani Pourvahid <mahdi-baghbani@azadehafzar.io>
//
// OpenCloudMesh Go - a runnable Open Cloud Mesh peer in Go, focused on a strict, WebDAV-centered subset of the protocol.

package config

import (
	"errors"
	"fmt"

	"github.com/MahdiBaghbani/opencloudmesh-go/internal/platform/http/realip"
	"github.com/MahdiBaghbani/opencloudmesh-go/internal/platform/store"
)

func validateValidatorTrustedProxies(cfg *Config) error {
	if !IsValidatorMode(cfg) {
		return nil
	}

	if _, err := realip.NewTrustedProxiesStrict(cfg.Server.TrustedProxies); err != nil {
		return fmt.Errorf("server.trusted_proxies: %w", err)
	}

	return nil
}

func validateValidatorStatistics(cfg *Config) error {
	if !IsValidatorMode(cfg) {
		return nil
	}

	if !cfg.Statistics.Enabled {
		return errors.New("mode=validator requires statistics.enabled=true")
	}

	if cfg.Persistence.Backend == BackendMemory {
		return errors.New("mode=validator requires a durable persistence backend for redaction salt")
	}

	if cfg.Persistence.Backend == BackendJSON {
		return fmt.Errorf(
			"mode=validator requires a SQLite-backed persistence backend: %w",
			store.ErrNoSharedSQLiteHandle,
		)
	}

	return nil
}

// validateValidatorSessionWindows fails closed when the declared
// reverse-share wait budget exceeds the stall window that enforces it: the
// stall sweep would otherwise interrupt the wait with reverse_share_timeout
// before the declared budget elapsed. Effective values come from
// SessionConfigFromValidator, so an absent or non-positive knob reads as its
// default here.
func validateValidatorSessionWindows(cfg *Config) error {
	if !IsValidatorMode(cfg) {
		return nil
	}

	session := SessionConfigFromValidator(cfg)

	if session.StallTimeoutSeconds <= 0 {
		return nil
	}

	if session.ReverseShareTimeoutSeconds > session.StallTimeoutSeconds {
		return fmt.Errorf(
			"validator.session.reverse_share_timeout_seconds (%d) must not exceed validator.session.stall_timeout_seconds (%d)",
			session.ReverseShareTimeoutSeconds,
			session.StallTimeoutSeconds,
		)
	}

	return nil
}

// validateValidatorSessionConcurrency fails closed on resolved
// concurrency-knob invariants. Effective values come from
// SessionConfigFromValidator, so an absent or non-positive knob reads as
// its default here. Raw negatives are rejected before overlay and never
// reach this check.
func validateValidatorSessionConcurrency(cfg *Config) error {
	if !IsValidatorMode(cfg) {
		return nil
	}

	session := SessionConfigFromValidator(cfg)

	if session.ReapIntervalSeconds > session.MaxDriveIdleSeconds {
		return fmt.Errorf(
			"validator.session.reap_interval_seconds (%d) must not exceed validator.session.max_drive_idle_seconds (%d)",
			session.ReapIntervalSeconds,
			session.MaxDriveIdleSeconds,
		)
	}

	if session.MaxDriveIdleSeconds <= 0 || session.MaxDriveIdleSeconds >= session.StallTimeoutSeconds {
		return fmt.Errorf(
			"validator.session.max_drive_idle_seconds (%d) must be greater than 0 and less than validator.session.stall_timeout_seconds (%d)",
			session.MaxDriveIdleSeconds,
			session.StallTimeoutSeconds,
		)
	}

	if session.SessionLimit < 1 || session.SessionLimit > 256 {
		return fmt.Errorf(
			"validator.session.session_limit (%d) must be between 1 and 256",
			session.SessionLimit,
		)
	}

	if session.MaxDispatchAttempts <= 0 {
		return fmt.Errorf(
			"validator.session.max_dispatch_attempts (%d) must be greater than 0",
			session.MaxDispatchAttempts,
		)
	}

	if session.BackoffBaseSeconds <= 0 {
		return fmt.Errorf(
			"validator.session.backoff_base_seconds (%d) must be greater than 0",
			session.BackoffBaseSeconds,
		)
	}

	if session.BackoffCapSeconds < session.BackoffBaseSeconds {
		return fmt.Errorf(
			"validator.session.backoff_cap_seconds (%d) must be greater than or equal to validator.session.backoff_base_seconds (%d)",
			session.BackoffCapSeconds,
			session.BackoffBaseSeconds,
		)
	}

	return nil
}

func validateValidatorScanPublicRatelimit(cfg *Config) error {
	if !IsValidatorMode(cfg) {
		return nil
	}

	startPublic, err := StartPublicRatelimitProfile(cfg)
	if err != nil {
		return err
	}

	if err := validateCompleteRatelimitBucket(
		startPublic,
		fmt.Sprintf(
			"http.interceptors.ratelimit.profiles.%s.%s",
			ScanPublicRatelimitProfile,
			StartPublicRatelimitBucket,
		),
	); err != nil {
		return err
	}

	if cfg.HTTP.Services == nil {
		return errors.New("mode=validator requires http.services.validator.ratelimit profile scan_public")
	}

	svcCfg, ok := cfg.HTTP.Services["validator"]
	if !ok {
		return errors.New("mode=validator requires http.services.validator")
	}

	rlCfg, ok := svcCfg["ratelimit"]
	if !ok {
		return errors.New("mode=validator requires http.services.validator.ratelimit")
	}

	rlMap, ok := rlCfg.(map[string]any)
	if !ok {
		return errors.New("http.services.validator.ratelimit must be a map")
	}

	profile, ok := rlMap["profile"].(string)
	if !ok || profile != ScanPublicRatelimitProfile {
		return fmt.Errorf(
			"http.services.validator.ratelimit.profile must be %q",
			ScanPublicRatelimitProfile,
		)
	}

	return nil
}

// StartPublicRatelimitProfile returns the start_public bucket under scan_public.
func StartPublicRatelimitProfile(cfg *Config) (map[string]any, error) {
	if cfg == nil {
		return nil, errors.New("config is nil")
	}

	if cfg.HTTP.Interceptors == nil {
		return nil, fmt.Errorf(
			"missing http.interceptors.ratelimit.profiles.%s.%s",
			ScanPublicRatelimitProfile,
			StartPublicRatelimitBucket,
		)
	}

	rlCfg, ok := cfg.HTTP.Interceptors["ratelimit"]
	if !ok {
		return nil, fmt.Errorf(
			"missing http.interceptors.ratelimit.profiles.%s.%s",
			ScanPublicRatelimitProfile,
			StartPublicRatelimitBucket,
		)
	}

	profilesRaw, ok := rlCfg["profiles"]
	if !ok {
		return nil, fmt.Errorf(
			"missing http.interceptors.ratelimit.profiles.%s.%s",
			ScanPublicRatelimitProfile,
			StartPublicRatelimitBucket,
		)
	}

	profiles, ok := profilesRaw.(map[string]any)
	if !ok {
		return nil, errors.New("http.interceptors.ratelimit.profiles must be a map")
	}

	scanPublic, ok := profiles[ScanPublicRatelimitProfile]
	if !ok {
		return nil, fmt.Errorf("missing http.interceptors.ratelimit.profiles.%s", ScanPublicRatelimitProfile)
	}

	scanMap, ok := scanPublic.(map[string]any)
	if !ok {
		return nil, fmt.Errorf("http.interceptors.ratelimit.profiles.%s must be a map", ScanPublicRatelimitProfile)
	}

	startPublic, ok := scanMap[StartPublicRatelimitBucket]
	if !ok {
		return nil, fmt.Errorf(
			"missing http.interceptors.ratelimit.profiles.%s.%s",
			ScanPublicRatelimitProfile,
			StartPublicRatelimitBucket,
		)
	}

	startMap, ok := startPublic.(map[string]any)
	if !ok {
		return nil, fmt.Errorf(
			"http.interceptors.ratelimit.profiles.%s.%s must be a map",
			ScanPublicRatelimitProfile,
			StartPublicRatelimitBucket,
		)
	}

	return startMap, nil
}

// validateCompleteRatelimitBucket requires both limiter fields to be present and
// positive, matching the ratelimit interceptor contract without runtime defaults.
func validateCompleteRatelimitBucket(bucket map[string]any, path string) error {
	if bucket == nil {
		return fmt.Errorf("%s must be a map", path)
	}

	requestsRaw, ok := bucket["requests_per_window"]
	if !ok {
		return fmt.Errorf("%s.requests_per_window is required", path)
	}

	requests, err := positiveInt64Field(requestsRaw, path+".requests_per_window")
	if err != nil {
		return err
	}

	if requests <= 0 {
		return fmt.Errorf("%s.requests_per_window must be positive", path)
	}

	windowRaw, ok := bucket["window_seconds"]
	if !ok {
		return fmt.Errorf("%s.window_seconds is required", path)
	}

	window, err := positiveIntField(windowRaw, path+".window_seconds")
	if err != nil {
		return err
	}

	if window <= 0 {
		return fmt.Errorf("%s.window_seconds must be positive", path)
	}

	return nil
}

func positiveInt64Field(value any, field string) (int64, error) {
	switch n := value.(type) {
	case int64:
		return n, nil
	case int:
		return int64(n), nil
	case float64:
		if n != float64(int64(n)) {
			return 0, fmt.Errorf("%s must be an integer", field)
		}

		return int64(n), nil
	default:
		return 0, fmt.Errorf("%s must be an integer", field)
	}
}

func positiveIntField(value any, field string) (int, error) {
	n, err := positiveInt64Field(value, field)
	if err != nil {
		return 0, err
	}

	return int(n), nil
}