file-engine 2.0.0

use std::collections::{HashMap, HashSet};
use std::path::{Path, PathBuf};

use crate::error::{Error, Result};
use crate::paths::normalize_for_comparison;

use super::fs_caps::FilesystemCapabilities;
use super::workload::{DirEntry, Entry, Workload};

/// Entries `validate()` removed from the `Workload` before it ever
/// reaches the Planner, paired with why. Unlike a typical pre-flight
/// check, these aren't necessarily whole-operation failures — the
/// pipeline layer applies `ErrorStrategy` to decide what happens next,
/// same as any other per-entry failure.
#[derive(Debug, Default)]
pub(crate) struct ValidationOutcome {
    pub rejected_entries: Vec<(Entry, Error)>,
    /// Full `DirEntry`, not just a path — mirrors `rejected_entries`.
    /// This module has no notion of a destination path (it only knows
    /// `relative_path`s and `dest_caps`); the pipeline layer computes
    /// the actual destination path the same way it already does for
    /// `ensure_directories_exist`/`apply_directory_permissions`.
    pub rejected_directories: Vec<(DirEntry, Error)>,
}

/// Checks `workload` against what `dest_caps` can actually represent,
/// removing anything that can't be copied as-is. Only the exFAT-on-macOS
/// write-integrity risk is a true whole-operation failure (it isn't a
/// property of any specific entry — every write to that destination carries
/// it) — everything else is per-entry, reflected in the returned
/// `ValidationOutcome` rather than an `Err`.
/// `allow_filesystem_integrity_risk` is the one override this feature has —
/// every other rejection is per-entry and already governed by the caller's
/// `ErrorStrategy`, which needs no override here.
pub(crate) fn validate(
    workload: &mut Workload,
    dest_caps: &FilesystemCapabilities,
    allow_filesystem_integrity_risk: bool,
) -> Result<ValidationOutcome> {
    if dest_caps.write_integrity_risk && !allow_filesystem_integrity_risk {
        return Err(Error::FilesystemIntegrityRisk {
            filesystem: dest_caps.name.clone(),
        });
    }

    let mut outcome = ValidationOutcome::default();

    if !dest_caps.case_sensitive {
        reject_case_collisions(workload, &mut outcome);
    }

    retain_entries(
        &mut workload.small,
        dest_caps,
        &mut outcome.rejected_entries,
    );
    retain_entries(
        &mut workload.large,
        dest_caps,
        &mut outcome.rejected_entries,
    );
    retain_directories(
        &mut workload.directories,
        dest_caps,
        &mut outcome.rejected_directories,
    );

    Ok(outcome)
}

/// Case-folded, Unicode-normalized key two entries collide under on a
/// case-insensitive destination — folds in item 6 (normalization) so a
/// destination-side NFC rewrite of an NFD source name doesn't dodge
/// detection here the same way it wouldn't dodge exFAT's real
/// case-insensitive lookup.
fn collision_key(relative_path: &Path) -> String {
    normalize_for_comparison(relative_path)
        .to_string_lossy()
        .to_lowercase()
}

/// Groups every file *and* directory by `collision_key` — a file and a
/// directory differing only by case collide just as badly as two files
/// would — and removes every member of any group with more than one
/// entry. Both entries in a colliding pair are rejected, not just one:
/// there's no principled way to pick a "winner", and silently keeping
/// one without saying so is the exact silent-loss problem this check
/// exists to prevent.
fn reject_case_collisions(workload: &mut Workload, outcome: &mut ValidationOutcome) {
    let mut groups: HashMap<String, Vec<PathBuf>> = HashMap::new();
    for entry in workload.small.iter().chain(&workload.large) {
        groups
            .entry(collision_key(&entry.relative_path))
            .or_default()
            .push(entry.relative_path.clone());
    }
    for dir in &workload.directories {
        groups
            .entry(collision_key(&dir.relative_path))
            .or_default()
            .push(dir.relative_path.clone());
    }

    let colliding_keys: HashSet<String> = groups
        .into_iter()
        .filter(|(_, paths)| paths.len() > 1)
        .map(|(key, _)| key)
        .collect();
    if colliding_keys.is_empty() {
        return;
    }

    // A second pass to know, for each rejected entry, which specific
    // sibling it collided with (for the error message) rather than just
    // "something, somewhere, collided".
    let mut siblings: HashMap<String, Vec<PathBuf>> = HashMap::new();
    for entry in workload.small.iter().chain(&workload.large) {
        let key = collision_key(&entry.relative_path);
        if colliding_keys.contains(&key) {
            siblings
                .entry(key)
                .or_default()
                .push(entry.relative_path.clone());
        }
    }
    for dir in &workload.directories {
        let key = collision_key(&dir.relative_path);
        if colliding_keys.contains(&key) {
            siblings
                .entry(key)
                .or_default()
                .push(dir.relative_path.clone());
        }
    }
    let other_for = |path: &Path, key: &str| -> PathBuf {
        siblings[key]
            .iter()
            .find(|candidate| candidate.as_path() != path)
            .cloned()
            .unwrap_or_else(|| path.to_path_buf())
    };

    for group in [&mut workload.small, &mut workload.large] {
        let mut i = 0;
        while i < group.len() {
            let key = collision_key(&group[i].relative_path);
            if colliding_keys.contains(&key) {
                let entry = group.remove(i);
                let other = other_for(&entry.relative_path, &key);
                let error = Error::CaseCollision {
                    path: entry.relative_path.clone(),
                    other,
                };
                outcome.rejected_entries.push((entry, error));
            } else {
                i += 1;
            }
        }
    }

    let mut i = 0;
    while i < workload.directories.len() {
        let key = collision_key(&workload.directories[i].relative_path);
        if colliding_keys.contains(&key) {
            let dir = workload.directories.remove(i);
            let other = other_for(&dir.relative_path, &key);
            let error = Error::CaseCollision {
                path: dir.relative_path.clone(),
                other,
            };
            outcome.rejected_directories.push((dir, error));
        } else {
            i += 1;
        }
    }
}

fn retain_entries(
    entries: &mut Vec<Entry>,
    dest_caps: &FilesystemCapabilities,
    rejected: &mut Vec<(Entry, Error)>,
) {
    let mut i = 0;
    while i < entries.len() {
        match entry_violation(&entries[i], dest_caps) {
            Some(err) => rejected.push((entries.remove(i), err)),
            None => i += 1,
        }
    }
}

fn entry_violation(entry: &Entry, dest_caps: &FilesystemCapabilities) -> Option<Error> {
    if let Some(max) = dest_caps.max_file_size {
        if entry.size > max {
            return Some(Error::FileTooLargeForDest {
                path: entry.relative_path.clone(),
                size: entry.size,
                max,
            });
        }
    }
    if dest_caps.windows_naming_rules {
        if let Some(err) = check_windows_naming(&entry.relative_path) {
            return Some(err);
        }
    }
    None
}

/// Directories go through the naming check too (a directory named `CON`
/// is exactly as broken as a file named `CON`) but not the size check —
/// directories have no size. The scanned root itself (`relative_path`
/// empty) never has anything to check: `Path::components()` on an empty
/// path yields no components, so the loop below naturally passes it
/// through without needing to special-case it.
fn retain_directories(
    directories: &mut Vec<DirEntry>,
    dest_caps: &FilesystemCapabilities,
    rejected: &mut Vec<(DirEntry, Error)>,
) {
    if !dest_caps.windows_naming_rules {
        return;
    }
    let mut i = 0;
    while i < directories.len() {
        match check_windows_naming(&directories[i].relative_path) {
            Some(err) => rejected.push((directories.remove(i), err)),
            None => i += 1,
        }
    }
}

/// Windows/NTFS/exFAT/FAT32's reserved-character set, reserved device
/// names, and trailing dot/space rule — empirically confirmed these are
/// enforced by Windows's own API layer, not the on-disk format itself
/// (every one of them was silently accepted when written directly to a
/// mounted exFAT drive from macOS), so this check applies based on
/// `dest_caps.windows_naming_rules` (destination filesystem type)
/// regardless of which OS is doing the writing.
const RESERVED_CHARS: &[char] = &['<', '>', ':', '"', '/', '\\', '|', '?', '*'];
const RESERVED_BASE_NAMES: &[&str] = &[
    "CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8",
    "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
];

fn check_windows_naming(relative_path: &Path) -> Option<Error> {
    for component in relative_path.components() {
        let std::path::Component::Normal(os_str) = component else {
            continue;
        };
        let name = os_str.to_string_lossy();

        let has_reserved_char = name
            .chars()
            .any(|c| RESERVED_CHARS.contains(&c) || (c as u32) < 0x20);
        let has_trailing_dot_or_space = name.ends_with('.') || name.ends_with(' ');
        let base = name.split('.').next().unwrap_or(&name);
        let is_reserved_name = RESERVED_BASE_NAMES
            .iter()
            .any(|reserved| reserved.eq_ignore_ascii_case(base));

        if has_reserved_char || has_trailing_dot_or_space || is_reserved_name {
            return Some(Error::ReservedName {
                path: relative_path.to_path_buf(),
            });
        }
    }
    None
}

#[cfg(test)]
mod tests {
    use std::time::Duration;

    use super::*;

    fn caps(overrides: impl FnOnce(&mut FilesystemCapabilities)) -> FilesystemCapabilities {
        let mut caps = FilesystemCapabilities {
            name: "test".to_string(),
            case_sensitive: true,
            max_file_size: None,
            windows_naming_rules: false,
            timestamp_granularity: Duration::ZERO,
            write_integrity_risk: false,
        };
        overrides(&mut caps);
        caps
    }

    fn entry(relative_path: &str, size: u64) -> Entry {
        Entry {
            path: PathBuf::from(relative_path),
            relative_path: PathBuf::from(relative_path),
            size,
            modified: None,
        }
    }

    fn dir(relative_path: &str) -> DirEntry {
        DirEntry {
            path: PathBuf::from(relative_path),
            relative_path: PathBuf::from(relative_path),
            mode: None,
        }
    }

    #[test]
    fn a_valid_workload_is_untouched() {
        let mut workload = Workload {
            small: vec![entry("a.txt", 10)],
            large: vec![entry("nested/big.bin", 1000)],
            directories: vec![dir(""), dir("nested")],
        };
        let dest_caps = caps(|_| {});

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(outcome.rejected_entries.is_empty());
        assert!(outcome.rejected_directories.is_empty());
        assert_eq!(workload.small.len(), 1);
        assert_eq!(workload.large.len(), 1);
        assert_eq!(workload.directories.len(), 2);
    }

    #[test]
    fn write_integrity_risk_returns_err_before_touching_the_workload() {
        let mut workload = Workload {
            small: vec![entry("a.txt", 10)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| {
            c.name = "exfat".to_string();
            c.write_integrity_risk = true;
        });

        let result = validate(&mut workload, &dest_caps, false);

        assert!(
            matches!(result, Err(Error::FilesystemIntegrityRisk { filesystem }) if filesystem == "exfat")
        );
        assert_eq!(
            workload.small.len(),
            1,
            "workload must be untouched when this short-circuits"
        );
    }

    #[test]
    fn allow_filesystem_integrity_risk_bypasses_the_check() {
        let mut workload = Workload {
            small: vec![entry("a.txt", 10)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| {
            c.name = "exfat".to_string();
            c.write_integrity_risk = true;
        });

        let outcome = validate(&mut workload, &dest_caps, true).unwrap();

        assert!(outcome.rejected_entries.is_empty());
        assert_eq!(
            workload.small.len(),
            1,
            "the entry should proceed normally once the risk is acknowledged"
        );
    }

    #[test]
    fn case_sensitive_destination_never_flags_collisions() {
        let mut workload = Workload {
            small: vec![entry("Report.txt", 1), entry("report.txt", 1)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.case_sensitive = true);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(outcome.rejected_entries.is_empty());
        assert_eq!(workload.small.len(), 2);
    }

    #[test]
    fn case_insensitive_destination_rejects_both_sides_of_a_collision() {
        let mut workload = Workload {
            small: vec![entry("Report.txt", 1), entry("report.txt", 1)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.case_sensitive = false);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(
            workload.small.is_empty(),
            "both colliding entries should be removed, not just one"
        );
        assert_eq!(outcome.rejected_entries.len(), 2);
        for (_, err) in &outcome.rejected_entries {
            assert!(matches!(err, Error::CaseCollision { .. }));
        }
    }

    #[test]
    fn a_file_and_a_directory_differing_only_by_case_collide() {
        let mut workload = Workload {
            small: vec![entry("Assets/readme.txt", 1)],
            large: vec![],
            directories: vec![dir("Assets"), dir("assets")],
        };
        let dest_caps = caps(|c| c.case_sensitive = false);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert_eq!(outcome.rejected_directories.len(), 2);
        assert!(workload.directories.is_empty());
        // The file inside `Assets/` isn't itself part of the collision
        // (its own relative path is unique) — only the two directory
        // entries collide.
        assert_eq!(workload.small.len(), 1);
    }

    #[test]
    fn normalization_differences_are_treated_as_the_same_name() {
        use unicode_normalization::UnicodeNormalization;

        let nfc: String = "café.txt".nfc().collect();
        let nfd: String = "café.txt".nfd().collect();
        assert_ne!(
            nfc.as_bytes(),
            nfd.as_bytes(),
            "test setup: these must start out byte-different"
        );

        let mut workload = Workload {
            small: vec![entry(&nfc, 1), entry(&nfd, 1)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.case_sensitive = false);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(workload.small.is_empty());
        assert_eq!(outcome.rejected_entries.len(), 2);
    }

    #[test]
    fn non_colliding_entries_survive_alongside_a_collision() {
        let mut workload = Workload {
            small: vec![
                entry("Report.txt", 1),
                entry("report.txt", 1),
                entry("unrelated.txt", 1),
            ],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.case_sensitive = false);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert_eq!(outcome.rejected_entries.len(), 2);
        assert_eq!(workload.small.len(), 1);
        assert_eq!(
            workload.small[0].relative_path,
            PathBuf::from("unrelated.txt")
        );
    }

    #[test]
    fn file_over_the_size_limit_is_rejected() {
        let mut workload = Workload {
            small: vec![],
            large: vec![entry("big.bin", 101)],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.max_file_size = Some(100));

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(workload.large.is_empty());
        assert_eq!(outcome.rejected_entries.len(), 1);
        assert!(matches!(
            outcome.rejected_entries[0].1,
            Error::FileTooLargeForDest {
                size: 101,
                max: 100,
                ..
            }
        ));
    }

    #[test]
    fn file_exactly_at_the_size_limit_is_kept() {
        let mut workload = Workload {
            small: vec![],
            large: vec![entry("big.bin", 100)],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.max_file_size = Some(100));

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(outcome.rejected_entries.is_empty());
        assert_eq!(workload.large.len(), 1);
    }

    #[test]
    fn no_size_limit_never_rejects_on_size() {
        let mut workload = Workload {
            small: vec![],
            large: vec![entry("huge.bin", u64::MAX)],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.max_file_size = None);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(outcome.rejected_entries.is_empty());
    }

    /// Uses `<` rather than `:` so the fixture parses identically on
    /// every host — see `a_colon_in_a_unix_filename_is_rejected_for_a_windows_destination`.
    #[test]
    fn reserved_character_in_a_filename_is_rejected_when_windows_naming_rules_apply() {
        let mut workload = Workload {
            small: vec![entry("a<b.txt", 1)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.windows_naming_rules = true);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(workload.small.is_empty());
        assert!(matches!(
            outcome.rejected_entries[0].1,
            Error::ReservedName { .. }
        ));
    }

    #[test]
    fn reserved_characters_are_allowed_when_windows_naming_rules_do_not_apply() {
        let mut workload = Workload {
            small: vec![entry("a<b.txt", 1)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.windows_naming_rules = false);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(outcome.rejected_entries.is_empty());
        assert_eq!(workload.small.len(), 1);
    }

    /// Not run on Windows: `a:b.txt` is a filename on Unix, but the
    /// same string parses as a drive-relative path there (prefix `a:`
    /// plus `b.txt`), so the colon never reaches the component loop —
    /// and no Windows filesystem could hand us such a name to scan
    /// anyway. The case that matters is precisely this one, a Unix
    /// source bound for a Windows-family destination, validated on the
    /// Unix host doing the copy.
    #[cfg(not(windows))]
    #[test]
    fn a_colon_in_a_unix_filename_is_rejected_for_a_windows_destination() {
        let mut workload = Workload {
            small: vec![entry("a:b.txt", 1)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.windows_naming_rules = true);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(workload.small.is_empty());
        assert!(matches!(
            outcome.rejected_entries[0].1,
            Error::ReservedName { .. }
        ));
    }

    /// Guards the reason `check_windows_naming` walks `Path::components()`
    /// instead of splitting the path string on separators: `\` is an
    /// ordinary character in a Unix filename, so `a\b.txt` is a single
    /// component here whose backslash has to be rejected for a Windows
    /// destination. Splitting on `\` would read it as two path segments
    /// and let the violation through.
    #[cfg(unix)]
    #[test]
    fn a_backslash_in_a_unix_filename_is_rejected_for_a_windows_destination() {
        let mut workload = Workload {
            small: vec![entry("a\\b.txt", 1)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.windows_naming_rules = true);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(workload.small.is_empty());
        assert!(matches!(
            outcome.rejected_entries[0].1,
            Error::ReservedName { .. }
        ));
    }

    #[test]
    fn reserved_device_name_is_rejected_case_insensitively_regardless_of_extension() {
        let dest_caps = caps(|c| c.windows_naming_rules = true);
        for name in [
            "CON", "con.txt", "NUL", "nul.log", "COM1", "com1.dat", "AUX",
        ] {
            let mut workload = Workload {
                small: vec![entry(name, 1)],
                large: vec![],
                directories: vec![],
            };
            let outcome = validate(&mut workload, &dest_caps, false).unwrap();
            assert!(
                workload.small.is_empty(),
                "{name} should have been rejected"
            );
            assert!(matches!(
                outcome.rejected_entries[0].1,
                Error::ReservedName { .. }
            ));
        }
    }

    #[test]
    fn a_name_that_merely_contains_a_reserved_word_is_not_rejected() {
        let mut workload = Workload {
            small: vec![entry("console.txt", 1)],
            large: vec![],
            directories: vec![],
        };
        let dest_caps = caps(|c| c.windows_naming_rules = true);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(outcome.rejected_entries.is_empty());
    }

    #[test]
    fn trailing_dot_or_space_is_rejected() {
        let dest_caps = caps(|c| c.windows_naming_rules = true);
        for name in ["trailing.", "trailing "] {
            let mut workload = Workload {
                small: vec![entry(name, 1)],
                large: vec![],
                directories: vec![],
            };
            let outcome = validate(&mut workload, &dest_caps, false).unwrap();
            assert!(
                workload.small.is_empty(),
                "{name:?} should have been rejected"
            );
            assert!(matches!(
                outcome.rejected_entries[0].1,
                Error::ReservedName { .. }
            ));
        }
    }

    #[test]
    fn reserved_directory_name_is_rejected() {
        let mut workload = Workload {
            small: vec![],
            large: vec![],
            directories: vec![dir("CON")],
        };
        let dest_caps = caps(|c| c.windows_naming_rules = true);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(workload.directories.is_empty());
        assert!(matches!(
            outcome.rejected_directories[0].1,
            Error::ReservedName { .. }
        ));
    }

    #[test]
    fn the_scanned_root_with_empty_relative_path_is_never_rejected() {
        let mut workload = Workload {
            small: vec![],
            large: vec![],
            directories: vec![dir("")],
        };
        let dest_caps = caps(|c| c.windows_naming_rules = true);

        let outcome = validate(&mut workload, &dest_caps, false).unwrap();

        assert!(outcome.rejected_directories.is_empty());
        assert_eq!(workload.directories.len(), 1);
    }
}