package unit;

import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

/**
 * traefik-0001/0002/0003: three CWE-407 defects — slices.Contains in hot loops.
 *
 * Test 1 (traefik-0001): removeConnectionHeaders
 *   slow: for each Connection token, scan xHeaders(11) + connectionHeaders(C) linearly.
 *   fast: pre-built HashSet, O(1) per lookup.
 *   Assert: slowOps > fastOps * 5 (C=50 connectionHeaders).
 *
 * Test 2 (traefik-0002): safeURL query param redaction
 *   slow: for each query param (Q), scan safeQueryParams(P) linearly.
 *   fast: pre-built HashSet, O(1) per lookup.
 *   Assert: slowOps > fastOps * 5 (Q=30, P=20).
 *
 * Test 3 (traefik-0003): PopulateUsedBy entryPoints validation
 *   slow: for each (router × entryPoint), scan entryPoints slice linearly.
 *   fast: pre-built HashSet, O(1) per lookup.
 *   Assert: slowOps > fastOps * 5 (R=500 routers, M=3 EPs each, E=20 entry points).
 */
public class TraefikAlgorithmTest {

    static long slowOps;
    static long fastOps;

    // =========================================================================
    // Test 1: traefik-0001 — removeConnectionHeaders slices.Contains
    // =========================================================================

    /**
     * Slow: O(H × (F1 + F2)) — linear scan of xHeaders then connectionHeaders
     * for each connection header token.
     */
    static boolean slowContains(List<String> list, String key) {
        for (String s : list) {
            slowOps++;
            if (s.equals(key)) return true;
        }
        return false;
    }

    static void slowRemoveConnectionHeaders(
            List<String> connectionTokens,
            List<String> xHeaders,
            List<String> connectionHeaders) {
        for (String token : connectionTokens) {
            if (slowContains(xHeaders, token)) continue;
            if (slowContains(connectionHeaders, token)) continue;
            // else: delete header (no-op in simulation)
        }
    }

    static void fastRemoveConnectionHeaders(
            List<String> connectionTokens,
            Set<String> xHeadersSet,
            Set<String> connectionHeadersSet) {
        for (String token : connectionTokens) {
            fastOps++;
            if (xHeadersSet.contains(token)) continue;
            fastOps++;
            if (connectionHeadersSet.contains(token)) continue;
        }
    }

    static boolean test1() {
        // 11 standard X-Forwarded headers (matches traefik xHeaders)
        List<String> xHeaders = new ArrayList<>();
        xHeaders.add("X-Forwarded-Proto");
        xHeaders.add("X-Forwarded-For");
        xHeaders.add("X-Forwarded-Host");
        xHeaders.add("X-Forwarded-Port");
        xHeaders.add("X-Forwarded-Server");
        xHeaders.add("X-Forwarded-Uri");
        xHeaders.add("X-Forwarded-Method");
        xHeaders.add("X-Forwarded-Prefix");
        xHeaders.add("X-Forwarded-Tls-Client-Cert");
        xHeaders.add("X-Forwarded-Tls-Client-Cert-Info");
        xHeaders.add("X-Real-Ip");

        // 50 user-configured connectionHeaders (worst-case deployment)
        final int C = 50;
        List<String> connectionHeaders = new ArrayList<>();
        for (int i = 0; i < C; i++) {
            connectionHeaders.add("X-Custom-Header-" + i);
        }

        // Fast versions use HashSet
        Set<String> xHeadersSet = new HashSet<>(xHeaders);
        Set<String> connectionHeadersSet = new HashSet<>(connectionHeaders);

        // 3 Connection tokens per request — last one hits connectionHeaders list (worst case)
        List<String> tokens = new ArrayList<>();
        tokens.add("keep-alive");
        tokens.add("upgrade");
        tokens.add("X-Custom-Header-" + (C - 1)); // worst case: match at end of list

        final int REQUESTS = 50_000;
        slowOps = 0;
        fastOps = 0;

        for (int r = 0; r < REQUESTS; r++) {
            slowRemoveConnectionHeaders(tokens, xHeaders, connectionHeaders);
        }
        long slowResult = slowOps;

        for (int r = 0; r < REQUESTS; r++) {
            fastRemoveConnectionHeaders(tokens, xHeadersSet, connectionHeadersSet);
        }
        long fastResult = fastOps;

        long ratio = slowResult / Math.max(fastResult, 1);
        boolean pass = slowResult > fastResult * 5;
        System.out.printf("traefik-0001  slow=%d  fast=%d  ratio=%dx  %s%n",
                slowResult, fastResult, ratio, pass ? "PASS" : "FAIL");
        return pass;
    }

    // =========================================================================
    // Test 2: traefik-0002 — safeURL slices.Contains O(Q×P)
    // =========================================================================

    static void slowSafeURL(List<String> queryParams, List<String> safeParams) {
        for (String param : queryParams) {          // O(Q)
            for (String safe : safeParams) {        // O(P)
                slowOps++;
                if (safe.equals(param)) break;
            }
        }
    }

    static void fastSafeURL(List<String> queryParams, Set<String> safeParamsSet) {
        for (String param : queryParams) {          // O(Q)
            fastOps++;                              // O(1) set lookup
            safeParamsSet.contains(param);
        }
    }

    static boolean test2() {
        final int P = 20; // safe query params configured
        final int Q = 30; // query params in URL

        List<String> safeParams = new ArrayList<>();
        for (int i = 0; i < P; i++) safeParams.add("safe_param_" + i);

        List<String> queryParams = new ArrayList<>();
        for (int i = 0; i < Q; i++) queryParams.add("param_" + i); // none safe = worst case

        Set<String> safeParamsSet = new HashSet<>(safeParams);

        final int REQUESTS = 50_000;
        slowOps = 0;
        fastOps = 0;

        for (int r = 0; r < REQUESTS; r++) slowSafeURL(queryParams, safeParams);
        long slowResult = slowOps;

        for (int r = 0; r < REQUESTS; r++) fastSafeURL(queryParams, safeParamsSet);
        long fastResult = fastOps;

        long ratio = slowResult / Math.max(fastResult, 1);
        boolean pass = slowResult > fastResult * (P - 1);
        System.out.printf("traefik-0002  slow=%d  fast=%d  ratio=%dx  %s%n",
                slowResult, fastResult, ratio, pass ? "PASS" : "FAIL");
        return pass;
    }

    // =========================================================================
    // Test 3: traefik-0003 — PopulateUsedBy entryPoints slices.Contains O(R×M×E)
    // =========================================================================

    static void slowPopulateUsedBy(
            int numRouters, int entryPointsPerRouter,
            List<String> allEntryPoints) {
        int E = allEntryPoints.size();
        for (int r = 0; r < numRouters; r++) {
            for (int m = 0; m < entryPointsPerRouter; m++) {
                // Each router uses the LAST entry point — worst case for linear scan
                String ep = allEntryPoints.get(E - 1);
                // linear scan of allEntryPoints slice (must walk all E before match)
                for (String validEp : allEntryPoints) {
                    slowOps++;
                    if (validEp.equals(ep)) break;
                }
            }
        }
    }

    static void fastPopulateUsedBy(
            int numRouters, int entryPointsPerRouter,
            List<String> allEntryPoints,
            Set<String> entryPointsSet) {
        int E = allEntryPoints.size();
        for (int r = 0; r < numRouters; r++) {
            for (int m = 0; m < entryPointsPerRouter; m++) {
                String ep = allEntryPoints.get(E - 1);
                fastOps++;
                entryPointsSet.contains(ep); // O(1)
            }
        }
    }

    static boolean test3() {
        final int R = 500; // routers
        final int M = 3;   // entry points per router
        final int E = 20;  // configured entry points

        List<String> allEntryPoints = new ArrayList<>();
        for (int i = 0; i < E; i++) allEntryPoints.add("web-" + i);

        Set<String> entryPointsSet = new HashSet<>(allEntryPoints);

        slowOps = 0;
        fastOps = 0;

        slowPopulateUsedBy(R, M, allEntryPoints);
        long slowResult = slowOps;

        fastPopulateUsedBy(R, M, allEntryPoints, entryPointsSet);
        long fastResult = fastOps;

        long ratio = slowResult / Math.max(fastResult, 1);
        // Worst case: scan all E entries before match. slowOps = R*M*E, fastOps = R*M
        boolean pass = slowResult > fastResult * (E - 1);
        System.out.printf("traefik-0003  slow=%d  fast=%d  ratio=%dx  %s%n",
                slowResult, fastResult, ratio, pass ? "PASS" : "FAIL");
        return pass;
    }

    // =========================================================================
    // Main
    // =========================================================================

    public static void main(String[] args) {
        boolean p1 = test1();
        boolean p2 = test2();
        boolean p3 = test3();

        boolean allPass = p1 && p2 && p3;
        if (!allPass) {
            System.err.println("FAIL: one or more traefik CWE-407 tests failed");
            System.exit(1);
        }
        System.out.println("ALL PASS");
    }
}