llm_db

defmodule LLMDb.Packaged do
  @moduledoc """
  Provides access to the packaged base snapshot.

  This is NOT a Source - it returns the pre-processed, version-stable snapshot
  that ships with each release. The snapshot has already been through the full
  ETL pipeline (normalize → validate → merge → enrich → filter → index).

  Sources (ModelsDev, Local, Config) provide raw data that gets merged ON TOP
  of this base snapshot.

  ## Loading Strategy

  Behavior controlled by `:compile_embed` configuration option:
  - `true` - Snapshot embedded at compile-time (zero runtime IO, recommended for production)
  - `false` - Snapshot loaded at runtime from priv directory with integrity checking

  ## Security

  Production deployments should use `compile_embed: true` to eliminate runtime atom
  creation and file I/O. Runtime mode includes SHA-256 integrity verification to
  prevent tampering with the snapshot file.

  ### Integrity Policy

  The `:integrity_policy` config option controls integrity check behavior:
  - `:strict` (default) - Fail on hash mismatch, treating it as tampering
  - `:warn` - Log warning and continue, useful in dev when snapshot regenerates frequently
  - `:off` - Skip mismatch warnings entirely

  In development, use `:warn` mode. The snapshot file is marked as an `@external_resource`,
  so Mix automatically recompiles the module when it changes, refreshing the hash.
  """

  require Logger

  @snapshot_filename "priv/llm_db/snapshot.json"
  @compile_path Path.join([Application.app_dir(:llm_db), @snapshot_filename])

  # Always mark snapshot as external resource so Mix recompiles when it changes
  @external_resource @compile_path

  # Compile-time integrity hash (computed only if file exists at compile time)
  @snapshot_sha (if File.exists?(@compile_path) do
                   @compile_path
                   |> File.read!()
                   |> then(&:crypto.hash(:sha256, &1))
                   |> Base.encode16(case: :lower)
                 else
                   nil
                 end)

  @doc """
  Returns the absolute path to the packaged snapshot file.

  ## Returns

  String path to `priv/llm_db/snapshot.json` within the application directory.
  """
  @spec path() :: String.t()
  def path do
    Application.app_dir(:llm_db, @snapshot_filename)
  end

  if Application.compile_env(:llm_db, :compile_embed, false) do
    @compile_path Path.join([Application.app_dir(:llm_db), @snapshot_filename])
    @external_resource @compile_path

    snapshot_content = File.read!(@compile_path)
    # Safe: During compile-time, we control the snapshot content
    # The snapshot is generated by mix llm_db.activate which validates all keys
    @snapshot Jason.decode!(snapshot_content, keys: :atoms)

    @doc """
    Returns the packaged base snapshot (compile-time embedded).

    This snapshot is the pre-processed output of the ETL pipeline and serves
    as the stable foundation for this package version.

    ## Returns

    Fully indexed snapshot map with providers, models, and indexes, or `nil` if not available.
    """
    @spec snapshot() :: map() | nil
    def snapshot, do: @snapshot
  else
    @doc """
    Returns the packaged base snapshot (runtime loaded with integrity check).

    This snapshot is the pre-processed output of the ETL pipeline and serves
    as the stable foundation for this package version.

    Includes SHA-256 integrity verification to prevent tampering.

    ## Returns

    Fully indexed snapshot map with providers, models, and indexes, or `nil` if not available.
    """
    @spec snapshot() :: map() | nil
    def snapshot do
      with {:ok, content} <- File.read(path()),
           :ok <- verify_integrity(content) do
        decoded = Jason.decode!(content, keys: :atoms)
        validate_schema(decoded)
        decoded
      else
        {:error, :tampered} ->
          Logger.error(
            "llm_db: snapshot integrity check failed - file may have been tampered with. " <>
              "Refusing to load potentially malicious snapshot."
          )

          nil

        {:error, reason} ->
          Logger.warning("llm_db: failed to load snapshot: #{inspect(reason)}")
          nil
      end
    end

    defp integrity_policy do
      Application.get_env(:llm_db, :integrity_policy, :strict)
    end

    if is_nil(@snapshot_sha) do
      defp verify_integrity(_content), do: :ok
    else
      @expected_hash @snapshot_sha
      defp verify_integrity(content) do
        computed_hash =
          content
          |> then(&:crypto.hash(:sha256, &1))
          |> Base.encode16(case: :lower)

        cond do
          secure_compare(@expected_hash, computed_hash) ->
            :ok

          integrity_policy() in [:warn, :off] ->
            Logger.warning(
              "llm_db: snapshot integrity mismatch (expected #{String.slice(@expected_hash, 0..7)}..., got #{String.slice(computed_hash, 0..7)}...). " <>
                "Treating as stale in #{integrity_policy()} mode. If you just ran `mix llm_db.build`, " <>
                "this is expected; the module will auto-recompile on next build."
            )

            :ok

          true ->
            {:error, :tampered}
        end
      end

      # Constant-time string comparison to prevent timing attacks
      defp secure_compare(a, b) when byte_size(a) == byte_size(b) do
        import Bitwise
        a_bytes = :binary.bin_to_list(a)
        b_bytes = :binary.bin_to_list(b)

        result =
          Enum.zip(a_bytes, b_bytes)
          |> Enum.reduce(0, fn {x, y}, acc -> acc ||| bxor(x, y) end)

        result == 0
      end

      defp secure_compare(_, _), do: false
    end

    defp validate_schema(snapshot) when is_map(snapshot) do
      # Lightweight schema checks to prevent atom/memory exhaustion
      case snapshot do
        %{providers: providers} when is_map(providers) ->
          provider_count = map_size(providers)

          if provider_count > 1000 do
            Logger.warning(
              "llm_db: snapshot contains unusually large number of providers: #{provider_count}. " <>
                "Expected < 1000. Potential DoS attempt."
            )
          end

          # Check provider IDs match safe regex
          Enum.each(providers, fn {provider_id, _data} ->
            unless is_atom(provider_id) and
                     Atom.to_string(provider_id) =~ ~r/^[a-z][a-z0-9_:-]{0,63}$/ do
              Logger.warning(
                "llm_db: snapshot contains suspicious provider ID: #{inspect(provider_id)}"
              )
            end
          end)

        _ ->
          :ok
      end

      :ok
    end
  end
end