CliOutputGuard.cs

namespace XISOSharp.Cli;

using Serilog;
using Logging;

/// <summary>
/// Input==output refusal checks (TODO #15, xdvdfs #36). Each check returns the
/// error line to print, or <c>null</c> when the output is safe. Kept in one
/// place so the per-mode wiring stays a two-liner and the rules are unit
/// testable; the streaming library APIs enforce the same rules as a backstop
/// (they throw <see cref="IOException"/>), but these pre-checks fire before
/// any prompt, move, or byte is touched.
/// </summary>
internal static class CliOutputGuard
{
    /// <summary>
    /// Flags the upstream #61 confusion: a known option spelling sitting in a
    /// positional slot (the main parser stops at the first non-flag token, so
    /// <c>game.iso -d ./new/</c> would otherwise be probed as a file named
    /// <c>-d</c>). Returns the error line, or <c>null</c> for anything that is
    /// not an exact known-flag spelling. CLI-025: there is no existence
    /// bypass — a file literally named like a flag stays reachable as
    /// <c>./-y</c> or by absolute path.
    /// </summary>
    public static string? CheckMisplacedFlag(string? token)
    {
        try
        {
            if (string.IsNullOrEmpty(token) || !MisplacedFlags.Contains(token))
                return null;

            return $"Error: {token} must come before ISO filenames" +
                   $" (e.g. -x {token} <value> game.iso);" +
                   " a flag after the first filename is read as a filename" +
                   " (use ./-flag if a file is really named this way)\n";
        }
        catch (Exception ex)
        {
            Log.Error(ex, "CheckMisplacedFlag failed");
            BugReporter.ReportException(ex, "CheckMisplacedFlag failed");
            return null;
        }
    }

    // CLI-023: covers every main-parser flag spelling (--xbe-info, --repair,
    // --salvage, --repair-out, --file-time included). -O/--output are verb-only
    // spellings, deliberately absent: warning about them here would misadvise.
    private static readonly HashSet<string> MisplacedFlags = new(StringComparer.Ordinal)
    {
        "-v", "-h", "--help", "-c", "-x", "--unpack", "-X", "-l", "-t", "-i",
        "--ls", "--xex-info", "--xbe-info", "--md5", "--sha256", "-V", "validate",
        "--validate", "--validate-checksums", "--validate-strict",
        "--validate-report", "--copy-out", "--copy-in", "--no-backup", "-r", "-q", "-Q", "-s", "-D",
        "-m", "-y", "--yes", "-n", "--no", "-d", "-o",
        "--skip-sectors", "--prepend-sectors", "--batch",
        "--batch-recursive", "--skip-existing", "--continue-on-error", "--pack", "--video",
        "--random", "--seed", "--wipe", "--trim", "--petrify", "--update",
        "--zar", "--all", "--best", "--compress", "--security-sectors",
        "--sectors", "--checksum", "--filetime", "--get-filetime", "--file-time",
        "--set-filetime", "--sector-layout", "--ranges", "--is-optimized",
        "--silent", "--dry-run", "--jobs", "--policy",
        "--repair", "--salvage", "--repair-out",
    };

    /// <summary>
    /// Rewrite (<c>-r</c>) runs <c>input → input.old</c> before writing, so an
    /// <c>-o</c> pointing at the input itself (or at the backup about to hold
    /// it) is refused: the former is just the default, the latter destroys data.
    /// </summary>
    public static string? CheckRewriteOutput(string xisoPath, string? outputName)
    {
        try
        {
            if (string.IsNullOrWhiteSpace(outputName))
                return null;

            if (XisoPaths.AreSamePath(xisoPath, outputName))
            {
                return $"Error: rewrite output {outputName} is the same file as the input;" +
                       " omit -o to rewrite in place\n";
            }

            if (XisoPaths.AreSamePath(xisoPath + ".old", outputName))
            {
                return $"Error: rewrite output {outputName} would overwrite the {xisoPath}.old backup;" +
                       " choose another name\n";
            }

            return null;
        }
        catch (Exception ex)
        {
            Log.Error(ex, "CheckRewriteOutput failed for {Input}", xisoPath);
            BugReporter.ReportException(ex, $"CheckRewriteOutput failed for {xisoPath}");
            // CLI-024: fail closed — an unverifiable comparison must block the
            // overwrite, not wave it through (null reads as safe).
            return
                $"Error: could not verify rewrite output {outputName ?? "<none>"} against {xisoPath} ({ex.Message}); refusing to overwrite\n";
        }
    }

    /// <summary>
    /// Single-input <c>-o</c> used by the redump batch modes (video/random/seed/
    /// wipe/trim/petrify/update/zar): the output must not be the input itself.
    /// </summary>
    public static string? CheckSingleInputOutput(string input, string? outputName)
    {
        try
        {
            if (string.IsNullOrWhiteSpace(outputName))
                return null;

            if (XisoPaths.AreSamePath(input, outputName))
            {
                return $"Error: -o output {outputName} is the same file as the input {input};" +
                       " choose another name\n";
            }

            return null;
        }
        catch (Exception ex)
        {
            Log.Error(ex, "CheckSingleInputOutput failed for {Input}", input);
            BugReporter.ReportException(ex, $"CheckSingleInputOutput failed for {input}");
            // CLI-024: fail closed (see CheckRewriteOutput).
            return
                $"Error: could not verify -o output {outputName ?? "<none>"} against {input} ({ex.Message}); refusing to overwrite\n";
        }
    }

    /// <summary>
    /// Rebuild output must not clobber any component (xiso, video, filler/seed,
    /// update) nor the sectors file it is read from while writing.
    /// </summary>
    public static string? CheckRebuildOutput(string output, string? securitySectorsPath,
        params string?[] parts)
    {
        try
        {
            foreach (string? part in parts)
            {
                if (!string.IsNullOrWhiteSpace(part) && XisoPaths.AreSamePath(part, output))
                {
                    return $"Error: rebuild output {output} is the same file as input {part};" +
                           " choose another name\n";
                }
            }

            if (!string.IsNullOrWhiteSpace(securitySectorsPath) &&
                XisoPaths.AreSamePath(securitySectorsPath, output))
            {
                return $"Error: rebuild output {output} is the same file as the sectors file {securitySectorsPath};" +
                       " choose another name\n";
            }

            return null;
        }
        catch (Exception ex)
        {
            Log.Error(ex, "CheckRebuildOutput failed for {Output}", output);
            BugReporter.ReportException(ex, $"CheckRebuildOutput failed for {output}");
            // CLI-024: fail closed (see CheckRewriteOutput).
            return
                $"Error: could not verify rebuild output {output} against its inputs ({ex.Message}); refusing to overwrite\n";
        }
    }

    /// <summary>
    /// Compress/decompress output (explicit or derived default) must not be the
    /// source file itself. Split-part collisions beyond the base name are caught
    /// by the library backstop (<see cref="CisoWriter.CompressToCso"/>).
    /// </summary>
    public static string? CheckImageOutput(string source, string output)
    {
        try
        {
            if (XisoPaths.AreSamePath(source, output))
            {
                return $"Error: output {output} is the same file as the input {source};" +
                       " choose another name\n";
            }

            return null;
        }
        catch (Exception ex)
        {
            Log.Error(ex, "CheckImageOutput failed for {Source}", source);
            BugReporter.ReportException(ex, $"CheckImageOutput failed for {source}");
            // CLI-024: fail closed (see CheckRewriteOutput).
            return $"Error: could not verify output {output} against {source} ({ex.Message}); refusing to overwrite\n";
        }
    }
}