tellaro-query-language 1.3.8

//! Value comparator for TQL query evaluation.
//!
//! Supports all TQL comparison operators with type coercion and flexible matching.

use crate::error::{Result, TqlError};
use crate::parser::Value as AstValue;
use once_cell::sync::Lazy;
use regex::Regex;
use serde_json::Value as JsonValue;
use std::collections::HashMap;
use std::net::IpAddr;
use std::str::FromStr;
use std::sync::Mutex;

/// Cache for compiled regex patterns to avoid recompilation on every invocation.
/// Bounded to MAX_REGEX_CACHE_SIZE entries; when full the cache is cleared to
/// prevent unbounded memory growth from adversarial or highly-varied patterns.
static REGEX_CACHE: Lazy<Mutex<HashMap<String, Regex>>> = Lazy::new(|| Mutex::new(HashMap::new()));

/// Maximum number of compiled regex patterns to cache. When the cache exceeds
/// this limit, it is cleared to prevent unbounded memory consumption in
/// long-running services processing user-supplied queries.
const MAX_REGEX_CACHE_SIZE: usize = 1024;

/// Compare two values using the specified operator
///
/// # Arguments
///
/// * `field_value` - The field value from the record
/// * `operator` - The comparison operator (eq, ne, gt, contains, etc.)
/// * `compare_value` - The value to compare against
///
/// # Returns
///
/// true if the comparison succeeds, false otherwise
pub fn compare(field_value: &JsonValue, operator: &str, compare_value: &AstValue) -> Result<bool> {
    match operator {
        "eq" | "=" => compare_eq(field_value, compare_value),
        "ne" | "!=" => compare_ne(field_value, compare_value),
        "eq_ci" => compare_eq_ci(field_value, compare_value),
        "gt" | ">" => compare_gt(field_value, compare_value),
        "gte" | ">=" => compare_gte(field_value, compare_value),
        "lt" | "<" => compare_lt(field_value, compare_value),
        "lte" | "<=" => compare_lte(field_value, compare_value),
        "contains" => compare_contains_ci(field_value, compare_value),
        "contains_cs" => compare_contains(field_value, compare_value),
        "startswith" => compare_startswith_ci(field_value, compare_value),
        "startswith_cs" => compare_startswith(field_value, compare_value),
        "endswith" => compare_endswith_ci(field_value, compare_value),
        "endswith_cs" => compare_endswith(field_value, compare_value),
        "matches" | "regex" | "regexp" => compare_matches(field_value, compare_value),
        "not_contains" => Ok(!compare_contains_ci(field_value, compare_value)?),
        "not_contains_cs" => Ok(!compare_contains(field_value, compare_value)?),
        "not_startswith" => Ok(!compare_startswith_ci(field_value, compare_value)?),
        "not_startswith_cs" => Ok(!compare_startswith(field_value, compare_value)?),
        "not_endswith" => Ok(!compare_endswith_ci(field_value, compare_value)?),
        "not_endswith_cs" => Ok(!compare_endswith(field_value, compare_value)?),
        "not_matches" | "not_regex" | "not_regexp" => {
            Ok(!compare_matches(field_value, compare_value)?)
        }
        "in" => compare_in_ci(field_value, compare_value),
        "in_cs" => compare_in(field_value, compare_value),
        "not_in" => Ok(!compare_in_ci(field_value, compare_value)?),
        "not_in_cs" => Ok(!compare_in(field_value, compare_value)?),
        "between" => compare_between(field_value, compare_value),
        "not_between" => Ok(!compare_between(field_value, compare_value)?),
        "is" => compare_is(field_value, compare_value),
        "is_not" => Ok(!compare_is(field_value, compare_value)?),
        "cidr" => compare_cidr(field_value, compare_value),
        "not_cidr" => Ok(!compare_cidr(field_value, compare_value)?),
        "any" => compare_contains_ci(field_value, compare_value),
        _ => Err(TqlError::OperatorError(format!(
            "Unknown operator: {}",
            operator
        ))),
    }
}

/// Equality comparison
fn compare_eq(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    Ok(values_equal(field_value, compare_value))
}

/// Inequality comparison
fn compare_ne(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    // Null field values should return false for ne (not comparable), unless
    // comparing against AstValue::Null where the equality check handles it.
    if field_value.is_null() && *compare_value != AstValue::Null {
        return Ok(false);
    }
    Ok(!values_equal(field_value, compare_value))
}

/// Greater than comparison (supports both numeric and string comparison)
fn compare_gt(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    if field_value.is_null() {
        return Ok(false);
    }
    compare_ordered(field_value, compare_value, |a, b| a > b, |a, b| a > b)
}

/// Greater than or equal comparison (supports both numeric and string comparison)
fn compare_gte(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    if field_value.is_null() {
        return Ok(false);
    }
    compare_ordered(field_value, compare_value, |a, b| a >= b, |a, b| a >= b)
}

/// Less than comparison (supports both numeric and string comparison)
fn compare_lt(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    if field_value.is_null() {
        return Ok(false);
    }
    compare_ordered(field_value, compare_value, |a, b| a < b, |a, b| a < b)
}

/// Less than or equal comparison (supports both numeric and string comparison)
fn compare_lte(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    if field_value.is_null() {
        return Ok(false);
    }
    compare_ordered(field_value, compare_value, |a, b| a <= b, |a, b| a <= b)
}

/// Contains comparison - case-sensitive (substring or array element)
fn compare_contains(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match field_value {
        JsonValue::String(s) => {
            let search = ast_value_to_string(compare_value);
            Ok(s.contains(&search))
        }
        JsonValue::Array(arr) => {
            // Check if array contains the value
            for item in arr {
                if values_equal(item, compare_value) {
                    return Ok(true);
                }
            }
            Ok(false)
        }
        _ => Ok(false),
    }
}

/// Contains comparison - case-insensitive (default behavior, matches Python)
fn compare_contains_ci(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match field_value {
        JsonValue::String(s) => {
            let search = ast_value_to_string(compare_value).to_lowercase();
            Ok(s.to_lowercase().contains(&search))
        }
        JsonValue::Array(arr) => {
            // Check if any array element contains the search string as a substring
            // (case-insensitive). This matches Python _compare_string which does
            // `e in f` (substring) for each element, not equality.
            let search = ast_value_to_string(compare_value).to_lowercase();
            for item in arr {
                if let JsonValue::String(item_str) = item {
                    if item_str.to_lowercase().contains(&search) {
                        return Ok(true);
                    }
                } else if values_equal(item, compare_value) {
                    return Ok(true);
                }
            }
            Ok(false)
        }
        _ => Ok(false),
    }
}

/// Starts with comparison - case-sensitive
fn compare_startswith(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match field_value {
        JsonValue::String(s) => {
            let prefix = ast_value_to_string(compare_value);
            Ok(s.starts_with(&prefix))
        }
        JsonValue::Array(arr) => {
            let prefix = ast_value_to_string(compare_value);
            for item in arr {
                if let JsonValue::String(item_str) = item {
                    if item_str.starts_with(&prefix) {
                        return Ok(true);
                    }
                }
            }
            Ok(false)
        }
        _ => Ok(false),
    }
}

/// Starts with comparison - case-insensitive (default behavior, matches Python)
fn compare_startswith_ci(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match field_value {
        JsonValue::String(s) => {
            let prefix = ast_value_to_string(compare_value).to_lowercase();
            Ok(s.to_lowercase().starts_with(&prefix))
        }
        JsonValue::Array(arr) => {
            let prefix = ast_value_to_string(compare_value).to_lowercase();
            for item in arr {
                if let JsonValue::String(item_str) = item {
                    if item_str.to_lowercase().starts_with(&prefix) {
                        return Ok(true);
                    }
                }
            }
            Ok(false)
        }
        _ => Ok(false),
    }
}

/// Ends with comparison - case-sensitive
fn compare_endswith(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match field_value {
        JsonValue::String(s) => {
            let suffix = ast_value_to_string(compare_value);
            Ok(s.ends_with(&suffix))
        }
        JsonValue::Array(arr) => {
            let suffix = ast_value_to_string(compare_value);
            for item in arr {
                if let JsonValue::String(item_str) = item {
                    if item_str.ends_with(&suffix) {
                        return Ok(true);
                    }
                }
            }
            Ok(false)
        }
        _ => Ok(false),
    }
}

/// Ends with comparison - case-insensitive (default behavior, matches Python)
fn compare_endswith_ci(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match field_value {
        JsonValue::String(s) => {
            let suffix = ast_value_to_string(compare_value).to_lowercase();
            Ok(s.to_lowercase().ends_with(&suffix))
        }
        JsonValue::Array(arr) => {
            let suffix = ast_value_to_string(compare_value).to_lowercase();
            for item in arr {
                if let JsonValue::String(item_str) = item {
                    if item_str.to_lowercase().ends_with(&suffix) {
                        return Ok(true);
                    }
                }
            }
            Ok(false)
        }
        _ => Ok(false),
    }
}

/// Case-insensitive equality comparison
fn compare_eq_ci(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match (field_value, compare_value) {
        (JsonValue::String(a), AstValue::String(b)) => Ok(a.to_lowercase() == b.to_lowercase()),
        // For non-string types, fall back to regular equality
        _ => compare_eq(field_value, compare_value),
    }
}

/// Regex match comparison with cached pattern compilation
fn compare_matches(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match field_value {
        JsonValue::String(s) => {
            let pattern = ast_value_to_string(compare_value);
            // Recover from a poisoned mutex rather than propagating the panic.
            let cache = REGEX_CACHE.lock().unwrap_or_else(|e| e.into_inner());
            if let Some(regex) = cache.get(&pattern) {
                return Ok(regex.is_match(s));
            }
            drop(cache);

            // Compile and cache the regex
            let regex = Regex::new(&pattern).map_err(|e| {
                TqlError::ValueError(format!("Invalid regex pattern '{}': {}", pattern, e))
            })?;
            let result = regex.is_match(s);
            let mut cache = REGEX_CACHE.lock().unwrap_or_else(|e| e.into_inner());
            // Evict all entries when the cache exceeds the size limit to prevent
            // unbounded memory growth from adversarial or highly-varied patterns.
            if cache.len() >= MAX_REGEX_CACHE_SIZE {
                cache.clear();
            }
            cache.insert(pattern, regex);
            Ok(result)
        }
        _ => Ok(false),
    }
}

/// IN comparison - case-sensitive (field value in list)
fn compare_in(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match compare_value {
        AstValue::List(list) => {
            // Array field: check if ANY element of the field array is in the comparison list
            if let JsonValue::Array(field_arr) = field_value {
                for elem in field_arr {
                    for compare_item in list {
                        if values_equal(elem, compare_item) {
                            return Ok(true);
                        }
                    }
                }
                return Ok(false);
            }
            // Scalar field: check if the value is in the comparison list
            for item in list {
                if values_equal(field_value, item) {
                    return Ok(true);
                }
            }
            Ok(false)
        }
        _ => Ok(false),
    }
}

/// IN comparison - case-insensitive (default behavior, matches Python)
fn compare_in_ci(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match compare_value {
        AstValue::List(list) => {
            // Pre-lowercase the comparison list items to avoid repeated allocations
            let lower_list: Vec<String> = list
                .iter()
                .map(|item| ast_value_to_string(item).to_lowercase())
                .collect();

            // Array field: check if ANY element of the field array is in the comparison list
            if let JsonValue::Array(field_arr) = field_value {
                for elem in field_arr {
                    if let JsonValue::String(s) = elem {
                        let field_lower = s.to_lowercase();
                        if lower_list.contains(&field_lower) {
                            return Ok(true);
                        }
                    } else {
                        for compare_item in list {
                            if values_equal(elem, compare_item) {
                                return Ok(true);
                            }
                        }
                    }
                }
                return Ok(false);
            }

            // Scalar field: check if the value is in the comparison list
            if let JsonValue::String(a) = field_value {
                let field_lower = a.to_lowercase();
                return Ok(lower_list.contains(&field_lower));
            }
            // Non-string scalar: fall back to equality
            for item in list {
                if values_equal(field_value, item) {
                    return Ok(true);
                }
            }
            Ok(false)
        }
        _ => Ok(false),
    }
}

/// BETWEEN comparison (field value between [min, max])
///
/// The parser normalizes both `field between [val1, val2]` (list syntax) and
/// `field between val1 and val2` (natural syntax) into `Value::List(vec![val1, val2])`,
/// so compare_value should always arrive as a two-element list. The non-list match arm
/// is a defensive guard for programmatic AST construction.
fn compare_between(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match compare_value {
        AstValue::List(list) if list.len() == 2 => {
            let min = &list[0];
            let max = &list[1];

            let gte_min = compare_numeric(field_value, min, |a, b| a >= b)?;
            let lte_max = compare_numeric(field_value, max, |a, b| a <= b)?;

            Ok(gte_min && lte_max)
        }
        _ => Err(TqlError::ValueError(
            "BETWEEN operator requires a list of exactly 2 values".to_string(),
        )),
    }
}

/// IS comparison (check for null)
fn compare_is(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    match compare_value {
        AstValue::Null => Ok(field_value.is_null()),
        _ => Ok(values_equal(field_value, compare_value)),
    }
}

/// CIDR comparison (check if IP is in CIDR range)
fn compare_cidr(field_value: &JsonValue, compare_value: &AstValue) -> Result<bool> {
    // Extract IP address from field value
    let ip_str = match field_value {
        JsonValue::String(s) => s.clone(),
        _ => json_to_string(field_value),
    };

    // Extract CIDR pattern from compare value
    let cidr_str = ast_value_to_string(compare_value);

    // Parse IP address
    let ip = match IpAddr::from_str(&ip_str) {
        Ok(addr) => addr,
        Err(_) => return Ok(false), // Invalid IP address
    };

    // Parse CIDR pattern
    // For now, we'll do a simple implementation
    // TODO: Use ipnetwork crate for proper CIDR matching
    let parts: Vec<&str> = cidr_str.split('/').collect();
    if parts.len() != 2 {
        return Ok(false); // Invalid CIDR format
    }

    let network_ip = match IpAddr::from_str(parts[0]) {
        Ok(addr) => addr,
        Err(_) => return Ok(false),
    };

    let prefix_len: u8 = match parts[1].parse() {
        Ok(len) => len,
        Err(_) => return Ok(false),
    };

    // Check if both IPs are the same version
    match (ip, network_ip) {
        (IpAddr::V4(ip_v4), IpAddr::V4(net_v4)) => check_ipv4_in_cidr(ip_v4, net_v4, prefix_len),
        (IpAddr::V6(ip_v6), IpAddr::V6(net_v6)) => check_ipv6_in_cidr(ip_v6, net_v6, prefix_len),
        _ => Ok(false), // Mismatched IP versions
    }
}

/// Check if IPv4 address is in CIDR range
fn check_ipv4_in_cidr(
    ip: std::net::Ipv4Addr,
    network: std::net::Ipv4Addr,
    prefix_len: u8,
) -> Result<bool> {
    if prefix_len > 32 {
        return Ok(false);
    }

    let ip_u32 = u32::from(ip);
    let net_u32 = u32::from(network);

    let mask = if prefix_len == 0 {
        0
    } else {
        !0u32 << (32 - prefix_len)
    };

    Ok((ip_u32 & mask) == (net_u32 & mask))
}

/// Check if IPv6 address is in CIDR range
fn check_ipv6_in_cidr(
    ip: std::net::Ipv6Addr,
    network: std::net::Ipv6Addr,
    prefix_len: u8,
) -> Result<bool> {
    if prefix_len > 128 {
        return Ok(false);
    }

    let ip_u128 = u128::from(ip);
    let net_u128 = u128::from(network);

    let mask = if prefix_len == 0 {
        0
    } else {
        !0u128 << (128 - prefix_len)
    };

    Ok((ip_u128 & mask) == (net_u128 & mask))
}

/// Helper: Compare numeric values with a predicate function
fn compare_numeric<F>(
    field_value: &JsonValue,
    compare_value: &AstValue,
    predicate: F,
) -> Result<bool>
where
    F: Fn(f64, f64) -> bool,
{
    let field_num = json_to_number(field_value);
    let compare_num = ast_value_to_number(compare_value);

    match (field_num, compare_num) {
        (Some(a), Some(b)) => Ok(predicate(a, b)),
        _ => Ok(false), // Can't compare non-numeric values
    }
}

/// Helper: Compare values with ordered comparison (supports both numeric and string)
/// This enables comparisons like @timestamp > '2026-01-01T00:00:00Z' where
/// ISO 8601 timestamps sort correctly as strings.
fn compare_ordered<NumF, StrF>(
    field_value: &JsonValue,
    compare_value: &AstValue,
    num_predicate: NumF,
    str_predicate: StrF,
) -> Result<bool>
where
    NumF: Fn(f64, f64) -> bool,
    StrF: Fn(&str, &str) -> bool,
{
    // Try numeric comparison first
    let field_num = json_to_number(field_value);
    let compare_num = ast_value_to_number(compare_value);

    if let (Some(a), Some(b)) = (field_num, compare_num) {
        return Ok(num_predicate(a, b));
    }

    // Fall back to string comparison if both are strings
    if let (JsonValue::String(field_str), AstValue::String(compare_str)) =
        (field_value, compare_value)
    {
        return Ok(str_predicate(field_str, compare_str));
    }

    // Can't compare mixed or unsupported types
    Ok(false)
}

/// Helper: Check if two values are equal (with type coercion)
fn values_equal(json_value: &JsonValue, ast_value: &AstValue) -> bool {
    match (json_value, ast_value) {
        (JsonValue::String(a), AstValue::String(b)) => a == b,
        (JsonValue::Number(a), AstValue::Integer(b)) => {
            // Try exact integer comparison first, then fall back to f64
            // (needed when mutators like |sum return float-based Numbers)
            a.as_i64() == Some(*b)
                || a.as_f64()
                    .map(|f| (f - *b as f64).abs() < f64::EPSILON)
                    .unwrap_or(false)
        }
        (JsonValue::Number(a), AstValue::Float(b)) => {
            if let Some(a_f) = a.as_f64() {
                (a_f - b).abs() < f64::EPSILON
            } else {
                false
            }
        }
        (JsonValue::Bool(a), AstValue::Boolean(b)) => a == b,
        (JsonValue::Null, AstValue::Null) => true,
        (JsonValue::Array(a), AstValue::List(b)) => {
            if a.len() != b.len() {
                return false;
            }
            for (json_item, ast_item) in a.iter().zip(b.iter()) {
                if !values_equal(json_item, ast_item) {
                    return false;
                }
            }
            true
        }
        // Type coercion for boolean-to-number
        (JsonValue::Bool(b), AstValue::Integer(i)) => {
            let bool_as_int = if *b { 1 } else { 0 };
            bool_as_int == *i
        }
        (JsonValue::Bool(b), AstValue::Float(f)) => {
            let bool_as_float = if *b { 1.0 } else { 0.0 };
            (bool_as_float - f).abs() < f64::EPSILON
        }
        // Type coercion for number-to-string and other cases
        _ => {
            // Try numeric comparison first
            if let (Some(json_num), Some(ast_num)) =
                (json_to_number(json_value), ast_value_to_number(ast_value))
            {
                return (json_num - ast_num).abs() < f64::EPSILON;
            }

            // Fall back to string comparison
            let json_str = json_to_string(json_value);
            let ast_str = ast_value_to_string(ast_value);
            json_str == ast_str
        }
    }
}

/// Helper: Convert JsonValue to number
fn json_to_number(value: &JsonValue) -> Option<f64> {
    match value {
        JsonValue::Number(n) => n.as_f64(),
        JsonValue::String(s) => s.parse::<f64>().ok(),
        JsonValue::Bool(true) => Some(1.0),
        JsonValue::Bool(false) => Some(0.0),
        _ => None,
    }
}

/// Helper: Convert AstValue to number
fn ast_value_to_number(value: &AstValue) -> Option<f64> {
    match value {
        AstValue::Integer(i) => Some(*i as f64),
        AstValue::Float(f) => Some(*f),
        AstValue::String(s) => s.parse::<f64>().ok(),
        AstValue::Boolean(true) => Some(1.0),
        AstValue::Boolean(false) => Some(0.0),
        _ => None,
    }
}

/// Helper: Convert JsonValue to string
fn json_to_string(value: &JsonValue) -> String {
    match value {
        JsonValue::String(s) => s.clone(),
        JsonValue::Number(n) => n.to_string(),
        JsonValue::Bool(b) => b.to_string(),
        JsonValue::Null => "null".to_string(),
        JsonValue::Array(_) | JsonValue::Object(_) => value.to_string(),
    }
}

/// Helper: Convert AstValue to string
fn ast_value_to_string(value: &AstValue) -> String {
    match value {
        AstValue::String(s) => s.clone(),
        AstValue::Integer(i) => i.to_string(),
        AstValue::Float(f) => f.to_string(),
        AstValue::Boolean(b) => b.to_string(),
        AstValue::Null => "null".to_string(),
        AstValue::List(list) => {
            let items: Vec<String> = list.iter().map(ast_value_to_string).collect();
            format!("[{}]", items.join(", "))
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use serde_json::json;

    #[test]
    fn test_compare_eq() {
        assert!(compare(&json!("test"), "eq", &AstValue::String("test".to_string())).unwrap());
        assert!(!compare(&json!("test"), "eq", &AstValue::String("other".to_string())).unwrap());
        assert!(compare(&json!(42), "eq", &AstValue::Integer(42)).unwrap());
        assert!(compare(&json!(true), "eq", &AstValue::Boolean(true)).unwrap());
    }

    #[test]
    fn test_compare_ne() {
        assert!(compare(&json!("test"), "ne", &AstValue::String("other".to_string())).unwrap());
        assert!(!compare(&json!("test"), "ne", &AstValue::String("test".to_string())).unwrap());
    }

    #[test]
    fn test_compare_gt() {
        assert!(compare(&json!(10), "gt", &AstValue::Integer(5)).unwrap());
        assert!(!compare(&json!(5), "gt", &AstValue::Integer(10)).unwrap());
        assert!(!compare(&json!(5), "gt", &AstValue::Integer(5)).unwrap());
    }

    #[test]
    fn test_compare_gte() {
        assert!(compare(&json!(10), "gte", &AstValue::Integer(5)).unwrap());
        assert!(compare(&json!(5), "gte", &AstValue::Integer(5)).unwrap());
        assert!(!compare(&json!(5), "gte", &AstValue::Integer(10)).unwrap());
    }

    #[test]
    fn test_compare_lt() {
        assert!(compare(&json!(5), "lt", &AstValue::Integer(10)).unwrap());
        assert!(!compare(&json!(10), "lt", &AstValue::Integer(5)).unwrap());
    }

    #[test]
    fn test_compare_lte() {
        assert!(compare(&json!(5), "lte", &AstValue::Integer(10)).unwrap());
        assert!(compare(&json!(5), "lte", &AstValue::Integer(5)).unwrap());
        assert!(!compare(&json!(10), "lte", &AstValue::Integer(5)).unwrap());
    }

    #[test]
    fn test_compare_contains() {
        assert!(compare(
            &json!("hello world"),
            "contains",
            &AstValue::String("world".to_string())
        )
        .unwrap());
        assert!(!compare(
            &json!("hello world"),
            "contains",
            &AstValue::String("foo".to_string())
        )
        .unwrap());

        // Array contains
        assert!(compare(
            &json!(["a", "b", "c"]),
            "contains",
            &AstValue::String("b".to_string())
        )
        .unwrap());
        assert!(!compare(
            &json!(["a", "b", "c"]),
            "contains",
            &AstValue::String("d".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_compare_startswith() {
        assert!(compare(
            &json!("hello world"),
            "startswith",
            &AstValue::String("hello".to_string())
        )
        .unwrap());
        assert!(!compare(
            &json!("hello world"),
            "startswith",
            &AstValue::String("world".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_compare_endswith() {
        assert!(compare(
            &json!("hello world"),
            "endswith",
            &AstValue::String("world".to_string())
        )
        .unwrap());
        assert!(!compare(
            &json!("hello world"),
            "endswith",
            &AstValue::String("hello".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_compare_matches() {
        assert!(compare(
            &json!("test123"),
            "matches",
            &AstValue::String(r"test\d+".to_string())
        )
        .unwrap());
        assert!(!compare(
            &json!("test"),
            "matches",
            &AstValue::String(r"test\d+".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_compare_in() {
        let list = AstValue::List(vec![
            AstValue::String("a".to_string()),
            AstValue::String("b".to_string()),
            AstValue::String("c".to_string()),
        ]);

        assert!(compare(&json!("b"), "in", &list).unwrap());
        assert!(!compare(&json!("d"), "in", &list).unwrap());
    }

    #[test]
    fn test_compare_not_in() {
        let list = AstValue::List(vec![
            AstValue::String("a".to_string()),
            AstValue::String("b".to_string()),
        ]);

        assert!(compare(&json!("c"), "not_in", &list).unwrap());
        assert!(!compare(&json!("a"), "not_in", &list).unwrap());
    }

    #[test]
    fn test_compare_between() {
        let range = AstValue::List(vec![AstValue::Integer(10), AstValue::Integer(20)]);

        assert!(compare(&json!(15), "between", &range).unwrap());
        assert!(compare(&json!(10), "between", &range).unwrap());
        assert!(compare(&json!(20), "between", &range).unwrap());
        assert!(!compare(&json!(5), "between", &range).unwrap());
        assert!(!compare(&json!(25), "between", &range).unwrap());
    }

    #[test]
    fn test_compare_is_null() {
        assert!(compare(&json!(null), "is", &AstValue::Null).unwrap());
        assert!(!compare(&json!("test"), "is", &AstValue::Null).unwrap());
    }

    #[test]
    fn test_compare_is_not_null() {
        assert!(compare(&json!("test"), "is_not", &AstValue::Null).unwrap());
        assert!(!compare(&json!(null), "is_not", &AstValue::Null).unwrap());
    }

    #[test]
    fn test_type_coercion() {
        // String to number
        assert!(compare(&json!("42"), "eq", &AstValue::Integer(42)).unwrap());
        assert!(compare(&json!("42"), "gt", &AstValue::Integer(40)).unwrap());

        // Number to string
        assert!(compare(&json!(42), "eq", &AstValue::String("42".to_string())).unwrap());

        // Boolean to number
        assert!(compare(&json!(true), "eq", &AstValue::Integer(1)).unwrap());
        assert!(compare(&json!(false), "eq", &AstValue::Integer(0)).unwrap());
    }

    #[test]
    fn test_contains_ci_array_substring() {
        // Array contains_ci should do substring matching, not equality
        // e.g., ["hello world", "foo"] contains "world" should be true
        assert!(compare(
            &json!(["hello world", "foo bar"]),
            "contains",
            &AstValue::String("world".to_string())
        )
        .unwrap());

        // Case-insensitive substring matching on array elements
        assert!(compare(
            &json!(["Hello World", "foo bar"]),
            "contains",
            &AstValue::String("hello".to_string())
        )
        .unwrap());

        // No element contains the search string
        assert!(!compare(
            &json!(["hello world", "foo bar"]),
            "contains",
            &AstValue::String("baz".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_contains_cs_array_substring() {
        // Case-sensitive contains on array: exact element match (values_equal)
        assert!(compare(
            &json!(["a", "b", "c"]),
            "contains_cs",
            &AstValue::String("b".to_string())
        )
        .unwrap());

        assert!(!compare(
            &json!(["a", "b", "c"]),
            "contains_cs",
            &AstValue::String("B".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_startswith_ci_array() {
        // Array startswith_ci should check if any element starts with the prefix
        assert!(compare(
            &json!(["hello world", "foo bar"]),
            "startswith",
            &AstValue::String("hello".to_string())
        )
        .unwrap());

        // Case-insensitive
        assert!(compare(
            &json!(["Hello World", "foo bar"]),
            "startswith",
            &AstValue::String("HELLO".to_string())
        )
        .unwrap());

        // No match
        assert!(!compare(
            &json!(["hello world", "foo bar"]),
            "startswith",
            &AstValue::String("baz".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_startswith_cs_array() {
        // Case-sensitive startswith on array
        assert!(compare(
            &json!(["hello world", "foo bar"]),
            "startswith_cs",
            &AstValue::String("hello".to_string())
        )
        .unwrap());

        // Case mismatch should fail
        assert!(!compare(
            &json!(["Hello World", "foo bar"]),
            "startswith_cs",
            &AstValue::String("hello".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_endswith_ci_array() {
        // Array endswith_ci should check if any element ends with the suffix
        assert!(compare(
            &json!(["hello world", "foo bar"]),
            "endswith",
            &AstValue::String("world".to_string())
        )
        .unwrap());

        // Case-insensitive
        assert!(compare(
            &json!(["Hello World", "foo bar"]),
            "endswith",
            &AstValue::String("WORLD".to_string())
        )
        .unwrap());

        // No match
        assert!(!compare(
            &json!(["hello world", "foo bar"]),
            "endswith",
            &AstValue::String("baz".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_endswith_cs_array() {
        // Case-sensitive endswith on array
        assert!(compare(
            &json!(["hello world", "foo bar"]),
            "endswith_cs",
            &AstValue::String("world".to_string())
        )
        .unwrap());

        // Case mismatch should fail
        assert!(!compare(
            &json!(["Hello World", "foo bar"]),
            "endswith_cs",
            &AstValue::String("WORLD".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_in_ci_case_insensitive() {
        // Case-insensitive IN matching
        let list = AstValue::List(vec![
            AstValue::String("Hello".to_string()),
            AstValue::String("World".to_string()),
        ]);

        assert!(compare(&json!("hello"), "in", &list).unwrap());
        assert!(compare(&json!("WORLD"), "in", &list).unwrap());
        assert!(!compare(&json!("foo"), "in", &list).unwrap());
    }

    #[test]
    fn test_in_ci_array_field() {
        // Case-insensitive IN with array field value
        let list = AstValue::List(vec![
            AstValue::String("Hello".to_string()),
            AstValue::String("World".to_string()),
        ]);

        // Array field with matching element (case-insensitive)
        assert!(compare(&json!(["hello", "foo"]), "in", &list).unwrap());
        assert!(compare(&json!(["bar", "WORLD"]), "in", &list).unwrap());
        assert!(!compare(&json!(["bar", "baz"]), "in", &list).unwrap());
    }

    #[test]
    fn test_not_startswith_array() {
        // not_startswith should negate startswith_ci on arrays
        assert!(!compare(
            &json!(["hello world", "foo bar"]),
            "not_startswith",
            &AstValue::String("hello".to_string())
        )
        .unwrap());

        assert!(compare(
            &json!(["hello world", "foo bar"]),
            "not_startswith",
            &AstValue::String("baz".to_string())
        )
        .unwrap());
    }

    #[test]
    fn test_not_endswith_array() {
        // not_endswith should negate endswith_ci on arrays
        assert!(!compare(
            &json!(["hello world", "foo bar"]),
            "not_endswith",
            &AstValue::String("world".to_string())
        )
        .unwrap());

        assert!(compare(
            &json!(["hello world", "foo bar"]),
            "not_endswith",
            &AstValue::String("baz".to_string())
        )
        .unwrap());
    }
}