tellaro-query-language 1.4.3

//! OpenSearch query executor for TQL.
//!
//! This module provides the core `execute_opensearch()` functionality that executes
//! TQL queries against OpenSearch with automatic post-processing for mutators that
//! cannot be pushed down to the database (is_private, is_global, geo, etc.).
//!
//! # Features
//!
//! - TQL to OpenSearch DSL conversion
//! - Automatic scroll API for scan_all mode (unlimited results)
//! - Post-processing for mutators not supported by OpenSearch
//! - Health status tracking
//! - Query analysis and optimization
//!
//! # Example
//!
//! ```no_run
//! use tellaro_query_language::opensearch::{OpenSearchConfig, TqlExecutor, ExecuteOptions};
//!
//! #[tokio::main]
//! async fn main() -> Result<(), Box<dyn std::error::Error>> {
//!     let config = OpenSearchConfig::from_env()?;
//!     let executor = TqlExecutor::new(config)?;
//!
//!     let result = executor.execute_opensearch(
//!         "source.ip | is_private eq true",
//!         "endpoint-*",
//!         ExecuteOptions::default().with_scan_all(true),
//!     ).await?;
//!
//!     println!("Found {} results", result.total);
//!     Ok(())
//! }
//! ```

use super::error::{OpenSearchError, Result};
use super::field_mappings::FieldMappings;
use super::post_processor::PostProcessor;
use super::query_builder::QueryBuilder;
use super::OpenSearchConfig;
use crate::Tql;
use opensearch::OpenSearch;
use serde::{Deserialize, Serialize};
use serde_json::{json, Value as JsonValue};

/// Source of field mappings used for TQL query generation.
///
/// This enum tracks where field mappings came from, enabling clear debug logging
/// to understand whether intelligent field selection was used and from what source.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
pub enum MappingSource {
    /// Mappings provided directly via `with_field_mappings()` (e.g., from index templates)
    Provided {
        /// Number of field mappings provided
        field_count: usize,
    },
    /// Mappings fetched from OpenSearch index via `with_mappings_from_index()`
    FetchedFromIndex {
        /// Index pattern used to fetch mappings
        index: String,
        /// Number of field mappings fetched
        field_count: usize,
    },
    /// No mappings available (using raw field names without intelligent selection)
    None {
        /// Reason why no mappings are available
        reason: String,
    },
}

impl Default for MappingSource {
    fn default() -> Self {
        Self::None {
            reason: "Not configured".to_string(),
        }
    }
}

impl std::fmt::Display for MappingSource {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            MappingSource::Provided { field_count } => {
                write!(f, "Provided ({} fields)", field_count)
            }
            MappingSource::FetchedFromIndex { index, field_count } => {
                write!(f, "FetchedFromIndex '{}' ({} fields)", index, field_count)
            }
            MappingSource::None { reason } => {
                write!(f, "None ({})", reason)
            }
        }
    }
}

/// Result of executing a TQL query against OpenSearch.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ExecuteResult {
    /// Matching documents (post-processed if applicable)
    pub results: Vec<JsonValue>,

    /// Total number of results after post-processing
    pub total: usize,

    /// Total documents from OpenSearch before post-processing
    pub opensearch_total: usize,

    /// Whether post-processing was applied
    pub post_processing_applied: bool,

    /// Query health status: "green", "yellow", or "red"
    pub health_status: String,

    /// List of health issues/warnings
    pub health_reasons: Vec<String>,

    /// Scroll/scan information
    pub scan_info: Option<ScanInfo>,

    /// Error message if execution failed (None on success)
    pub error: Option<String>,

    /// The generated OpenSearch DSL query (for debugging)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub dsl_query: Option<JsonValue>,

    /// Source of field mappings used for query generation (for debugging)
    #[serde(default)]
    pub mapping_source: MappingSource,

    /// Aggregation results for stats queries (raw OpenSearch aggregations)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub aggregations: Option<JsonValue>,
}

impl Default for ExecuteResult {
    fn default() -> Self {
        Self {
            results: Vec::new(),
            total: 0,
            opensearch_total: 0,
            post_processing_applied: false,
            health_status: "green".to_string(),
            health_reasons: Vec::new(),
            scan_info: None,
            error: None,
            dsl_query: None,
            mapping_source: MappingSource::default(),
            aggregations: None,
        }
    }
}

impl ExecuteResult {
    /// Create an error result
    pub fn error(message: impl Into<String>) -> Self {
        let msg = message.into();
        Self {
            health_status: "red".to_string(),
            health_reasons: vec![msg.clone()],
            error: Some(msg),
            ..Default::default()
        }
    }
}

/// Information about scroll/scan operations.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ScanInfo {
    /// Number of scroll batches executed
    pub batches: usize,

    /// Total documents scrolled
    pub total_scrolled: usize,

    /// Scroll batch size
    pub scroll_size: usize,

    /// Whether scroll was used
    pub scroll_used: bool,
}

/// Options for executing a TQL query.
#[derive(Debug, Clone)]
pub struct ExecuteOptions {
    /// Whether to fetch all results using scroll API
    pub scan_all: bool,

    /// Scroll batch size (default: 10000)
    pub scroll_size: usize,

    /// Scroll timeout (default: "5m")
    pub scroll_timeout: String,

    /// Sort specification
    pub sort: Option<Vec<JsonValue>>,

    /// Time range filter
    pub time_range: Option<TimeRange>,

    /// Timestamp field name (default: "@timestamp")
    pub timestamp_field: String,

    /// Maximum results to return (ignored if scan_all is true)
    pub size: usize,
}

impl Default for ExecuteOptions {
    fn default() -> Self {
        Self {
            scan_all: false,
            scroll_size: 10000,
            scroll_timeout: "5m".to_string(),
            sort: None,
            time_range: None,
            timestamp_field: "@timestamp".to_string(),
            size: 10000,
        }
    }
}

impl ExecuteOptions {
    /// Enable scan_all mode for unlimited results
    pub fn with_scan_all(mut self, scan_all: bool) -> Self {
        self.scan_all = scan_all;
        self
    }

    /// Set scroll batch size
    pub fn with_scroll_size(mut self, size: usize) -> Self {
        self.scroll_size = size;
        self
    }

    /// Set scroll timeout
    pub fn with_scroll_timeout(mut self, timeout: impl Into<String>) -> Self {
        self.scroll_timeout = timeout.into();
        self
    }

    /// Set time range filter
    pub fn with_time_range(mut self, gte: impl Into<String>, lt: impl Into<String>) -> Self {
        self.time_range = Some(TimeRange {
            gte: gte.into(),
            lt: lt.into(),
        });
        self
    }

    /// Set timestamp field
    pub fn with_timestamp_field(mut self, field: impl Into<String>) -> Self {
        self.timestamp_field = field.into();
        self
    }

    /// Set sort specification
    pub fn with_sort(mut self, sort: Vec<JsonValue>) -> Self {
        self.sort = Some(sort);
        self
    }

    /// Set max results (only used when scan_all is false)
    pub fn with_size(mut self, size: usize) -> Self {
        self.size = size;
        self
    }
}

/// Time range for filtering.
#[derive(Debug, Clone)]
pub struct TimeRange {
    /// Greater than or equal to
    pub gte: String,
    /// Less than
    pub lt: String,
}

/// TQL query executor for OpenSearch.
///
/// Supports field mappings for intelligent query generation. When field mappings
/// are provided, the executor will use them to select appropriate field variants
/// (e.g., using `.keyword` subfield for exact matches on text fields).
pub struct TqlExecutor {
    client: OpenSearch,
    tql: Tql,
    query_builder: QueryBuilder,
    post_processor: PostProcessor,
    field_mappings: Option<FieldMappings>,
    /// Tracks where field mappings came from for debugging
    mapping_source: MappingSource,
}

impl TqlExecutor {
    /// Create a new TQL executor from configuration.
    pub fn new(config: OpenSearchConfig) -> Result<Self> {
        let client = config.create_client()?;
        Ok(Self {
            client,
            tql: Tql::new(),
            query_builder: QueryBuilder::new(None),
            post_processor: PostProcessor::new(),
            field_mappings: None,
            mapping_source: MappingSource::default(),
        })
    }

    /// Create a new TQL executor from an existing OpenSearch client.
    pub fn from_client(client: OpenSearch) -> Self {
        Self {
            client,
            tql: Tql::new(),
            query_builder: QueryBuilder::new(None),
            post_processor: PostProcessor::new(),
            field_mappings: None,
            mapping_source: MappingSource::default(),
        }
    }

    /// Set field mappings for intelligent query generation.
    ///
    /// Field mappings enable the executor to use appropriate field variants
    /// based on the operator being used. For example, for exact matches on
    /// text fields, it will use the `.keyword` subfield if available.
    ///
    /// # Arguments
    ///
    /// * `mappings` - Field mappings extracted from OpenSearch index mappings
    ///
    /// # Example
    ///
    /// ```ignore
    /// use tellaro_query_language::opensearch::{TqlExecutor, FieldMappings};
    ///
    /// let mappings_response = client.indices().get_mapping().send().await?;
    /// let field_mappings = FieldMappings::from_opensearch_response(mappings_response)?;
    ///
    /// let executor = TqlExecutor::from_client(client)
    ///     .with_field_mappings(field_mappings);
    /// ```
    pub fn with_field_mappings(mut self, mappings: FieldMappings) -> Self {
        let field_count = mappings.len();
        self.field_mappings = Some(mappings.clone());
        self.query_builder = QueryBuilder::new(Some(mappings));
        self.mapping_source = MappingSource::Provided { field_count };
        self
    }

    /// Fetch field mappings from an OpenSearch index and configure the executor.
    ///
    /// This is a convenience method that fetches mappings from the specified
    /// index pattern and configures the executor to use them.
    ///
    /// # Arguments
    ///
    /// * `index` - Index pattern to fetch mappings from (e.g., "endpoint-windows-*")
    ///
    /// # Returns
    ///
    /// Self with field mappings configured, or unchanged if fetching fails.
    pub async fn with_mappings_from_index(mut self, index: &str) -> Self {
        match self.fetch_field_mappings(index).await {
            Ok(mappings) => {
                let field_count = mappings.len();
                self.field_mappings = Some(mappings.clone());
                self.query_builder = QueryBuilder::new(Some(mappings));
                self.mapping_source = MappingSource::FetchedFromIndex {
                    index: index.to_string(),
                    field_count,
                };
            }
            Err(e) => {
                self.mapping_source = MappingSource::None {
                    reason: format!("Failed to fetch from '{}': {}", index, e),
                };
                tracing::warn!(
                    "Failed to fetch field mappings for index '{}': {}. Using default query generation.",
                    index, e
                );
            }
        }
        self
    }

    /// Get the source of field mappings being used.
    ///
    /// Returns information about where the field mappings came from,
    /// useful for debugging and logging.
    pub fn get_mapping_source(&self) -> &MappingSource {
        &self.mapping_source
    }

    /// Fetch field mappings from an OpenSearch index.
    ///
    /// # Arguments
    ///
    /// * `index` - Index pattern to fetch mappings from
    ///
    /// # Returns
    ///
    /// FieldMappings extracted from the index, or an error if fetching fails.
    pub async fn fetch_field_mappings(&self, index: &str) -> Result<FieldMappings> {
        let response = self
            .client
            .indices()
            .get_mapping(opensearch::indices::IndicesGetMappingParts::Index(&[index]))
            .send()
            .await
            .map_err(|e| OpenSearchError::MappingError(e.to_string()))?;

        let response_body = response.json::<JsonValue>().await.map_err(|e| {
            OpenSearchError::MappingError(format!("Failed to parse mapping response: {}", e))
        })?;

        FieldMappings::from_opensearch_response(response_body)
            .map_err(|e| OpenSearchError::MappingError(format!("Failed to parse mappings: {}", e)))
    }

    /// Execute a TQL query against OpenSearch.
    ///
    /// This is the main entry point that handles:
    /// 1. Parsing the TQL query
    /// 2. Checking for post-processing mutators
    /// 3. Converting to OpenSearch DSL
    /// 4. Executing with scroll API if scan_all is true
    /// 5. Applying post-processing for mutators not supported by OpenSearch
    ///
    /// # Arguments
    ///
    /// * `query` - TQL query string
    /// * `index` - Index pattern to search (e.g., "endpoint-*")
    /// * `options` - Execution options
    ///
    /// # Returns
    ///
    /// ExecuteResult containing matching documents and metadata
    pub async fn execute_opensearch(
        &self,
        query: &str,
        index: &str,
        options: ExecuteOptions,
    ) -> Result<ExecuteResult> {
        // Parse the TQL query
        let ast = match self.tql.parse(query) {
            Ok(ast) => ast,
            Err(e) => {
                return Ok(ExecuteResult::error(format!("Failed to parse TQL: {}", e)));
            }
        };

        // Check if query requires post-processing
        let needs_post_processing = self.tql.ast_has_post_processing_mutators(&ast);

        // Determine execution strategy
        let use_scroll = options.scan_all || needs_post_processing;

        // Build OpenSearch DSL query
        let dsl_query = match self.query_builder.build_query(&ast) {
            Ok(q) => q,
            Err(e) => {
                return Ok(ExecuteResult::error(format!(
                    "Failed to build DSL query: {}",
                    e
                )));
            }
        };

        // Add time range filter if specified
        let final_query = self.add_time_range_filter(dsl_query, &options);

        // Debug log the generated DSL query. Uses tracing::debug! (not an
        // unconditional eprintln) so it is filtered out at INFO and above, and
        // when emitted is captured at DEBUG level by the host's tracing
        // subscriber instead of being mis-surfaced as ERROR on stderr.
        tracing::debug!(
            "Generated OpenSearch DSL:\n{}",
            serde_json::to_string_pretty(&final_query)
                .unwrap_or_else(|_| "Failed to serialize".to_string())
        );

        // Execute the query
        if use_scroll {
            self.execute_with_scroll(query, index, final_query, options, needs_post_processing)
                .await
        } else {
            self.execute_simple(query, index, final_query, options, needs_post_processing)
                .await
        }
    }

    /// Add time range filter to the query.
    fn add_time_range_filter(&self, mut query: JsonValue, options: &ExecuteOptions) -> JsonValue {
        if let Some(ref time_range) = options.time_range {
            let range_filter = json!({
                "range": {
                    &options.timestamp_field: {
                        "gte": &time_range.gte,
                        "lt": &time_range.lt,
                        "format": "strict_date_optional_time"
                    }
                }
            });

            // Add to existing bool filter or create new bool query
            if let Some(query_obj) = query.get_mut("query") {
                if let Some(bool_query) = query_obj.get_mut("bool") {
                    // Add to existing filter array
                    if let Some(filter_arr) = bool_query.get_mut("filter") {
                        if let Some(arr) = filter_arr.as_array_mut() {
                            arr.push(range_filter);
                        }
                    } else {
                        bool_query["filter"] = json!([range_filter]);
                    }
                } else {
                    // Wrap existing query in bool with filter
                    let existing = query_obj.take();
                    *query_obj = json!({
                        "bool": {
                            "must": [existing],
                            "filter": [range_filter]
                        }
                    });
                }
            } else {
                // No query object, create one
                query["query"] = json!({
                    "bool": {
                        "filter": [range_filter]
                    }
                });
            }
        }

        query
    }

    /// Execute query with scroll API for unlimited results.
    async fn execute_with_scroll(
        &self,
        tql_query: &str,
        index: &str,
        query: JsonValue,
        options: ExecuteOptions,
        needs_post_processing: bool,
    ) -> Result<ExecuteResult> {
        let mut all_hits: Vec<JsonValue> = Vec::new();
        let mut batches = 0;

        // Build scroll query
        let mut scroll_query = query.clone();
        scroll_query["size"] = json!(options.scroll_size);

        // Add sort if specified
        if let Some(ref sort) = options.sort {
            scroll_query["sort"] = json!(sort);
        } else {
            // Default sort by timestamp descending
            scroll_query["sort"] = json!([{&options.timestamp_field: {"order": "desc"}}]);
        }

        // Initial scroll search
        let response = self
            .client
            .search(opensearch::SearchParts::Index(&[index]))
            .scroll(&options.scroll_timeout)
            .body(scroll_query)
            .send()
            .await
            .map_err(|e| OpenSearchError::SearchError(e.to_string()))?;

        let response_body = response.json::<JsonValue>().await.map_err(|e| {
            OpenSearchError::SearchError(format!("Failed to parse response: {}", e))
        })?;

        // Check for errors
        if let Some(error) = response_body.get("error") {
            return Ok(ExecuteResult::error(format!("OpenSearch error: {}", error)));
        }

        // Extract scroll ID and hits
        let mut scroll_id = response_body
            .get("_scroll_id")
            .and_then(|s| s.as_str())
            .map(|s| s.to_string());

        let opensearch_total = response_body
            .get("hits")
            .and_then(|h| h.get("total"))
            .and_then(|t| {
                if let Some(obj) = t.as_object() {
                    obj.get("value").and_then(|v| v.as_u64())
                } else {
                    t.as_u64()
                }
            })
            .unwrap_or(0) as usize;

        // Collect first batch
        if let Some(hits) = response_body
            .get("hits")
            .and_then(|h| h.get("hits"))
            .and_then(|h| h.as_array())
        {
            all_hits.extend(hits.clone());
            batches += 1;
        }

        // Continue scrolling until no more results
        while let Some(ref current_scroll_id) = scroll_id {
            // Don't continue if we got fewer results than scroll_size (last batch)
            let last_batch_size = response_body
                .get("hits")
                .and_then(|h| h.get("hits"))
                .and_then(|h| h.as_array())
                .map(|a| a.len())
                .unwrap_or(0);

            if last_batch_size == 0 {
                break;
            }

            // Scroll request
            let scroll_response = self
                .client
                .scroll(opensearch::ScrollParts::None)
                .scroll(&options.scroll_timeout)
                .body(json!({
                    "scroll_id": current_scroll_id
                }))
                .send()
                .await
                .map_err(|e| OpenSearchError::ScrollError(e.to_string()))?;

            let scroll_body = scroll_response.json::<JsonValue>().await.map_err(|e| {
                OpenSearchError::ScrollError(format!("Failed to parse scroll response: {}", e))
            })?;

            // Check for errors - don't fail, we have partial results
            if scroll_body.get("error").is_some() {
                break;
            }

            // Extract hits from scroll response
            let hits = scroll_body
                .get("hits")
                .and_then(|h| h.get("hits"))
                .and_then(|h| h.as_array());

            match hits {
                Some(batch) if !batch.is_empty() => {
                    all_hits.extend(batch.clone());
                    batches += 1;

                    // Update scroll_id for next iteration
                    scroll_id = scroll_body
                        .get("_scroll_id")
                        .and_then(|s| s.as_str())
                        .map(|s| s.to_string());
                }
                _ => {
                    // No more results
                    break;
                }
            }
        }

        // Clear scroll context
        if let Some(ref final_scroll_id) = scroll_id {
            let _ = self
                .client
                .clear_scroll(opensearch::ClearScrollParts::None)
                .body(json!({ "scroll_id": [final_scroll_id] }))
                .send()
                .await;
        }

        // Extract _source documents and merge _id/_score metadata (like Python TQL does)
        // The agent layer is responsible for wrapping into full OpenSearch hit format
        let source_docs: Vec<JsonValue> = all_hits
            .iter()
            .filter_map(|hit| {
                let mut doc = hit.get("_source").cloned()?;
                // Merge _id and _score into the document (Python TQL behavior)
                if let Some(obj) = doc.as_object_mut() {
                    if let Some(id) = hit.get("_id") {
                        obj.insert("_id".to_string(), id.clone());
                    }
                    if let Some(score) = hit.get("_score") {
                        obj.insert("_score".to_string(), score.clone());
                    }
                }
                Some(doc)
            })
            .collect();

        // Apply post-processing if needed
        let (final_results, post_processing_applied) = if needs_post_processing {
            match self
                .post_processor
                .process_results(source_docs.clone(), tql_query)
            {
                Ok(filtered) => (filtered, true),
                Err(_e) => {
                    // Post-processing failed, return unfiltered results
                    (source_docs, false)
                }
            }
        } else {
            (source_docs, false)
        };

        let total = final_results.len();

        // Determine health status
        let (health_status, health_reasons) = if needs_post_processing {
            (
                "yellow".to_string(),
                vec!["Query requires post-processing mutators".to_string()],
            )
        } else {
            ("green".to_string(), Vec::new())
        };

        Ok(ExecuteResult {
            results: final_results,
            total,
            opensearch_total,
            post_processing_applied,
            health_status,
            health_reasons,
            scan_info: Some(ScanInfo {
                batches,
                total_scrolled: all_hits.len(),
                scroll_size: options.scroll_size,
                scroll_used: true,
            }),
            error: None,
            dsl_query: Some(query.clone()),
            mapping_source: self.mapping_source.clone(),
            aggregations: None, // Scroll doesn't return aggregations
        })
    }

    /// Execute simple query without scroll.
    async fn execute_simple(
        &self,
        tql_query: &str,
        index: &str,
        query: JsonValue,
        options: ExecuteOptions,
        needs_post_processing: bool,
    ) -> Result<ExecuteResult> {
        // Store original query for debugging
        let original_query = query.clone();

        // Build query with size (don't override size=0 for stats queries)
        let mut final_query = query;
        let is_stats_query = final_query.get("aggs").is_some();
        if !is_stats_query {
            final_query["size"] = json!(options.size);
        }

        // Add sort if specified
        if let Some(ref sort) = options.sort {
            final_query["sort"] = json!(sort);
        }

        // Execute search
        let response = self
            .client
            .search(opensearch::SearchParts::Index(&[index]))
            .body(final_query)
            .send()
            .await
            .map_err(|e| OpenSearchError::SearchError(e.to_string()))?;

        let response_body = response.json::<JsonValue>().await.map_err(|e| {
            OpenSearchError::SearchError(format!("Failed to parse response: {}", e))
        })?;

        // Check for errors
        if let Some(error) = response_body.get("error") {
            return Ok(ExecuteResult::error(format!("OpenSearch error: {}", error)));
        }

        let opensearch_total = response_body
            .get("hits")
            .and_then(|h| h.get("total"))
            .and_then(|t| {
                if let Some(obj) = t.as_object() {
                    obj.get("value").and_then(|v| v.as_u64())
                } else {
                    t.as_u64()
                }
            })
            .unwrap_or(0) as usize;

        // Extract _source documents and merge _id/_score metadata (like Python TQL does)
        // The agent layer is responsible for wrapping into full OpenSearch hit format
        let source_docs: Vec<JsonValue> = response_body
            .get("hits")
            .and_then(|h| h.get("hits"))
            .and_then(|h| h.as_array())
            .map(|hits| {
                hits.iter()
                    .filter_map(|hit| {
                        let mut doc = hit.get("_source").cloned()?;
                        // Merge _id and _score into the document (Python TQL behavior)
                        if let Some(obj) = doc.as_object_mut() {
                            if let Some(id) = hit.get("_id") {
                                obj.insert("_id".to_string(), id.clone());
                            }
                            if let Some(score) = hit.get("_score") {
                                obj.insert("_score".to_string(), score.clone());
                            }
                        }
                        Some(doc)
                    })
                    .collect()
            })
            .unwrap_or_default();

        // Apply post-processing if needed
        let (final_results, post_processing_applied) = if needs_post_processing {
            match self
                .post_processor
                .process_results(source_docs.clone(), tql_query)
            {
                Ok(filtered) => (filtered, true),
                Err(_e) => {
                    // Post-processing failed, return unfiltered results
                    (source_docs, false)
                }
            }
        } else {
            (source_docs, false)
        };

        let total = final_results.len();

        // Extract aggregations for stats queries
        let aggregations = response_body.get("aggregations").cloned();

        Ok(ExecuteResult {
            results: final_results,
            total,
            opensearch_total,
            post_processing_applied,
            health_status: "green".to_string(),
            health_reasons: Vec::new(),
            scan_info: None,
            error: None,
            dsl_query: Some(original_query),
            mapping_source: self.mapping_source.clone(),
            aggregations,
        })
    }

    /// Analyze a TQL query for post-processing requirements.
    ///
    /// Useful for debugging and understanding query health before execution.
    pub fn analyze_query(&self, query: &str) -> QueryAnalysis {
        match self.tql.parse(query) {
            Ok(ast) => {
                let has_post_processing = self.tql.ast_has_post_processing_mutators(&ast);
                let mutators = Tql::extract_mutators_from_ast(&ast);

                QueryAnalysis {
                    has_post_processing,
                    health_status: if has_post_processing {
                        "yellow".to_string()
                    } else {
                        "green".to_string()
                    },
                    health_reasons: if has_post_processing {
                        vec!["Query contains post-processing mutators".to_string()]
                    } else {
                        Vec::new()
                    },
                    post_processing_mutators: mutators
                        .into_iter()
                        .flat_map(|(_, muts)| muts.into_iter().map(|m| m.name))
                        .collect(),
                    error: None,
                }
            }
            Err(e) => QueryAnalysis {
                has_post_processing: false,
                health_status: "red".to_string(),
                health_reasons: vec![format!("Parse error: {}", e)],
                post_processing_mutators: Vec::new(),
                error: Some(e.to_string()),
            },
        }
    }
}

/// Result of analyzing a TQL query.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct QueryAnalysis {
    /// Whether the query requires post-processing
    pub has_post_processing: bool,

    /// Health status: "green", "yellow", or "red"
    pub health_status: String,

    /// Health issues/warnings
    pub health_reasons: Vec<String>,

    /// List of mutators requiring post-processing
    pub post_processing_mutators: Vec<String>,

    /// Error message if analysis failed
    pub error: Option<String>,
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_execute_options_default() {
        let options = ExecuteOptions::default();
        assert!(!options.scan_all);
        assert_eq!(options.scroll_size, 10000);
        assert_eq!(options.scroll_timeout, "5m");
        assert_eq!(options.timestamp_field, "@timestamp");
    }

    #[test]
    fn test_execute_options_builder() {
        let options = ExecuteOptions::default()
            .with_scan_all(true)
            .with_scroll_size(5000)
            .with_scroll_timeout("10m")
            .with_timestamp_field("timestamp")
            .with_time_range("2024-01-01T00:00:00Z", "2024-01-02T00:00:00Z");

        assert!(options.scan_all);
        assert_eq!(options.scroll_size, 5000);
        assert_eq!(options.scroll_timeout, "10m");
        assert_eq!(options.timestamp_field, "timestamp");
        assert!(options.time_range.is_some());
    }

    #[test]
    fn test_execute_result_error() {
        let result = ExecuteResult::error("Test error");
        assert_eq!(result.health_status, "red");
        assert_eq!(result.error, Some("Test error".to_string()));
        assert!(result.health_reasons.contains(&"Test error".to_string()));
    }
}