once

defmodule Once do
  @format_docs """
  - `:url64` a url64-encoded string of 11 characters, for example `"AAjhfZyAAAE"`
  - `:hex` a hex-encoded string of 16 characters, for example `"E010831058218A39"`
  - `:raw` a bitstring of 64 bits, for example `<<0, 8, 225, 125, 156, 128, 0, 2>>`
  - `:signed` a signed 64-bits integer, like `-12345`, between -(2^63) and 2^63-1
  - `:unsigned` an unsigned 64-bits integer, like `67890`, between 0 and 2^64-1
  """
  @options_docs """
  - `:no_noncense` name of the NoNoncense instance used to generate new IDs (default `Once`)
  - `:ex_format` what an ID looks like in Elixir, one of `t:format/0`. Be sure to read [the caveats](`m:Once#module-elixir-format-caveats`) (default `:url64`).
  - `:db_format` what an ID looks like in your database, one of `t:format/0` (default `:signed`)
  - `:nonce_type` how the nonce is generated, one of `t:nonce_type/0` (default `:counter`)
  - `:get_key` a zero-arity getter for the 192-bits encryption key, required if encryption is enabled
  - `:encrypt?` **deprecated**, use `nonce_type: :encrypted` (default `false`).
  """

  @moduledoc """
  Once is an Ecto type for locally unique 64-bits IDs generated by multiple Elixir nodes. Locally unique IDs make it easier to keep things separated, simplify caching and simplify inserting related things (because you don't have to wait for the database to return the ID). A Once can be generated in multiple ways:

  - counter (default): really fast to generate, predictable, works well with b-tree indexes
  - encrypted: unique and unpredictable, like a UUIDv4 but shorter
  - sortable: time-sortable like a [Snowflake ID](https://en.wikipedia.org/wiki/Snowflake_ID)

  A Once can look however you want, and can be stored in multiple ways as well. By default, in Elixir it's a url64-encoded 11-char string, and in the database it's a signed bigint. By using the `:ex_format` and `:db_format` options, you can choose both the Elixir and storage format out of `t:format/0`. You can pick any combination and use `to_format/2` to transform them as you wish!

  Because a Once fits into an SQL bigint, they use little space and keep indexes small and fast. Because of their [structure](https://hexdocs.pm/no_noncense/NoNoncense.html#module-how-it-works) they have counter-like data locality, which helps your indexes perform well, [unlike UUIDv4s](https://www.cybertec-postgresql.com/en/unexpected-downsides-of-uuid-keys-in-postgresql/). If you don't care about that and want unpredictable IDs, you can use encrypted IDs that seem random and are still unique.

  The actual values are generated by `NoNoncense`, which performs incredibly well, hitting rates of tens of millions of nonces per second, and it also helps you to safeguard the uniqueness guarantees.

  The library has only `Ecto` and its sibling `NoNoncense` as dependencies.

  ## Usage

  To get going, you need to set up a `NoNoncense` instance to generate the base unique values. Follow [its documentation](https://hexdocs.pm/no_noncense) to do so. `Once` expects an instance with its own module name by default, like so:

      # application.ex (read the NoNoncense docs!)
      machine_id = NoNoncense.MachineId.id!(opts)
      NoNoncense.init(name: Once, machine_id: machine_id)

  In your `Ecto` schemas, you can then use the type:

      schema "things" do
        field :id, Once
      end

  And that's it!

  ## Options

  The Ecto type takes a few optional parameters:

  #{@options_docs}

  ## Data formats

  There's a drawback to having different data formats for Elixir and SQL: it makes it harder to compare the two. The following are all the same ID:

      -1
      <<255, 255, 255, 255, 255, 255, 255, 255>>
      "__________8"
      18_446_744_073_709_551_615
      "FFFFFFFFFFFFFFFF"

  If you use the defaults `:url64` as the Elixir format and `:signed` in your database, you could see `"AAAAAACYloA"` in Elixir and `10_000_000` in your database. The reasoning behind these defaults is that the encoded format is readable, short, and JSON safe by default, while the signed format means you can use a standard bigint column type.

  The negative integers will not cause problems with Postgres and MySQL, they both happily swallow them. Also, negative integers will only start to appear after ~70 years of usage.

  If you don't like the formats, it's really easy to change them! The Elixir format especially, which can be changed at any time.

  The supported formats are:

  #{@format_docs}

  ### Elixir format caveats

  Some caveats apply to the `:ex_format` options.

  > #### Don't use raw integers with JS clients {: .warning}
  >
  > Encode `:signed` and `:unsigned` as strings.

  While JSON does not impose a precision limit on numbers, JavaScript can't deal with >= 2^53 numbers. That means the first 11 nonce bits can't be used, so the first 11 timestamp bits can't be used, which leaves 33 timestamp bits, which will run out after exactly 24 days, so let's say immediately. If you want to use integers, convert them to strings.

  > #### `ex_format: :signed` and `:unsigned` disable encoded binary parsing {: .info}
  >
  > If you use an integer format as `:ex_format`, casting and dumping hex-encoded, url64-encoded and raw formats will be disabled. On the other hand, parsing stringified integers ("123") will be supported.

  That's because we can't disambiguate some binaries that are valid hex, url64 and raw binaries and also valid stringified integers. An example is "12345678901", which is either integer 12_345_678_901 or url64-encoded `<<215, 109, 248, 231, 174, 252, 247, 77>>` (a.k.a. quite a different number).

  By treating all incoming binaries as either a valid stringified integer or invalid when using an integer Elixir format, this ambiguity is resolved at the cost of some flexibility. Note that `to_format/2` does *not* support stringified integers, but that does mean it converts reliably between formats once values have been cast/dumped/loaded.

  > #### `ex_format: :hex`, `:url64` and `:raw` disable stringified integer parsing {: .info}
  >
  > If you use hex-encoded, url64-encoded or raw binary as `:ex_format`, parsing stringified integers will be disabled. On the other hand, parsing those binary formats is enabled.

  ## On local uniqueness

  By locally unique, we mean unique within your domain or application. UUIDs are globally unique across domains, servers and applications. A Once is not, because 64 bits is not enough to achieve that. It is enough for local uniqueness however: you can generate 8 million IDs per second on 512 machines in parallel for 140 years straight before you run out of bits, by which time your great-grandchildren will deal with the problem. Even higher burst rates are possible and you can use separate `NoNoncense` instanses for every table if you wish.

  ## Encrypted IDs

  By default, IDs are generated using a machine init timestamp, machine ID and counter (although they should be considered to be opague). This means they leak a little information and are somewhat predictable. If you don't like that, you can use encrypted IDs by passing options `nonce_type: :encrypted` and `get_key: fn -> <<_::192>> end`. Note that encrypted IDs will cost you the data locality and decrease index performance a little. The encryption algorithm is 3DES and that can't be changed. If you want to know why, take a look at [NoNoncense](https://hexdocs.pm/no_noncense/NoNoncense.html#module-encrypted-nonces).
  """
  require Logger
  use Ecto.ParameterizedType

  @typedoc """
  Formats in which a `Once` can be rendered.
  They are all equivalent and can be transformed to one another.

  #{@format_docs}
  """
  @type format :: :url64 | :raw | :signed | :unsigned | :hex

  @typedoc """
  The way in which the underlying 64-bits nonce is generated.

  See `NoNoncense` for details.
  """
  @type nonce_type :: :counter | :encrypted | :sortable

  @typedoc """
  Options to initialize `Once`.

  #{@options_docs}
  """
  @type opts :: [
          no_noncense: module(),
          ex_format: format(),
          db_format: format(),
          encrypt?: boolean(),
          get_key: (-> <<_::24>>),
          nonce_type: nonce_type()
        ]

  @default_opts %{
    no_noncense: __MODULE__,
    ex_format: :url64,
    db_format: :signed,
    nonce_type: :counter
  }

  @int_formats [:signed, :unsigned]
  @encoded_formats [:url64, :hex]

  #######################
  # Type implementation #
  #######################

  @impl true
  def type(%{db_format: :raw}), do: :binary
  def type(%{db_format: format}) when format in @encoded_formats, do: :string
  def type(%{db_format: format}) when format in @int_formats, do: :integer

  @impl true
  @spec init(opts()) :: map()
  def init(opts \\ []) do
    opts
    |> Map.new()
    |> Enum.into(@default_opts)
    |> check_nonce_type_option()
  end

  @impl true
  def cast(nil, _), do: {:ok, nil}

  def cast(value, %{ex_format: ex_format}) when ex_format in @int_formats and is_binary(value) do
    parse_int_and(value, &convert_int(&1, ex_format))
  end

  def cast(value, params), do: to_format(value, params.ex_format)

  @impl true
  def load(nil, _, _), do: {:ok, nil}
  def load(value, _, params), do: to_format(value, params.ex_format)

  @impl true
  def dump(nil, _, _), do: {:ok, nil}

  def dump(value, _, params) when params.ex_format in @int_formats and is_binary(value) do
    parse_int_and(value, &maybe_convert(:int, &1, params.db_format))
  end

  def dump(value, _, params), do: to_format(value, params.db_format)

  @impl true
  def autogenerate(params = %{nonce_type: :counter}) do
    NoNoncense.nonce(params.no_noncense, 64) |> to_format!(params.ex_format)
  end

  def autogenerate(params = %{nonce_type: :sortable}) do
    NoNoncense.sortable_nonce(params.no_noncense, 64) |> to_format!(params.ex_format)
  end

  def autogenerate(params) do
    NoNoncense.encrypted_nonce(params.no_noncense, 64, params.get_key.())
    |> to_format!(params.ex_format)
  end

  #####################
  # Mapping functions #
  #####################

  @doc """
  Transform the different forms that a `Once` can take to one another.
  The formats can be found in `t:format/0`.

      iex> Once.to_format("4BCDEFghijk", :raw)
      {:ok, <<224, 16, 131, 16, 88, 33, 138, 57>>}
      iex> Once.to_format(<<224, 16, 131, 16, 88, 33, 138, 57>>, :signed)
      {:ok, -2301195303365014983}
      iex> Once.to_format(-2301195303365014983, :unsigned)
      {:ok, 16145548770344536633}
      iex> Once.to_format(16145548770344536633, :hex)
      {:ok, "E010831058218A39"}
      iex> Once.to_format("E010831058218a39", :url64)
      {:ok, "4BCDEFghijk"}

      iex> Once.to_format(-1, :url64)
      {:ok, "__________8"}
      iex> Once.to_format("__________8", :raw)
      {:ok, <<255, 255, 255, 255, 255, 255, 255, 255>>}
      iex> Once.to_format(<<255, 255, 255, 255, 255, 255, 255, 255>>, :unsigned)
      {:ok, 18446744073709551615}
      iex> Once.to_format(18446744073709551615, :hex)
      {:ok, "FFFFFFFFFFFFFFFF"}
      iex> Once.to_format("FFFFFFFFFFFFFFFF", :signed)
      {:ok, -1}

      iex> Once.to_format(Integer.pow(2, 64), :unsigned)
      :error
  """
  @spec to_format(binary() | integer(), format()) :: {:ok, binary() | integer()} | :error
  def to_format(value, format), do: identify_format(value) |> maybe_convert(value, format)

  @doc """
  Same as `to_format/2` but raises on error.

      iex> -200
      ...> |> Once.to_format!(:url64)
      ...> |> Once.to_format!(:raw)
      ...> |> Once.to_format!(:unsigned)
      ...> |> Once.to_format!(:hex)
      ...> |> Once.to_format!(:signed)
      -200

      iex> Once.to_format!(Integer.pow(2, 64), :unsigned)
      ** (ArgumentError) value could not be parsed
  """
  @spec to_format!(binary() | integer(), format()) :: binary() | integer()
  def to_format!(value, format) do
    case to_format(value, format) do
      {:ok, value} -> value
      _ -> raise ArgumentError, "value could not be parsed"
    end
  end

  ###########
  # Private #
  ###########

  @range Integer.pow(2, 64)
  @signed_min -Integer.pow(2, 63)
  @signed_max Integer.pow(2, 63) - 1
  @unsigned_max @range - 1

  # convert a signed to unsigned int and back
  defp convert_int(int, format)
  defp convert_int(int, _) when int < @signed_min, do: :error
  defp convert_int(int, _) when int > @unsigned_max, do: :error

  defp convert_int(int, :signed) when int > @signed_max, do: {:ok, int - @range}
  defp convert_int(int, :unsigned) when int < 0, do: {:ok, int + @range}

  defp convert_int(int, _), do: {:ok, int}

  # paddingless url64 en/decoding
  defp encode64(value), do: Base.url_encode64(value, padding: false)
  defp decode64(value), do: Base.url_decode64(value, padding: false)

  # hex en/decoding
  defp encode16(value), do: Base.encode16(value)
  defp decode16(value), do: Base.decode16(value, case: :mixed)

  # identify the value's format, where ints are grouped together for convert_int/2 to deal with
  defp identify_format(value)
  defp identify_format(<<_::88>>), do: :url64
  defp identify_format(<<_::64>>), do: :raw
  defp identify_format(<<_::128>>), do: :hex
  defp identify_format(int) when is_integer(int), do: :int
  defp identify_format(_), do: :error

  # convert (or verify) a value from one format to another
  defp maybe_convert(format_in, value, format_out)
  defp maybe_convert(:raw, value, :raw), do: {:ok, value}

  defp maybe_convert(:url64, value, :url64) do
    # we must check that the encoding is valid
    case decode64(value) do
      {:ok, _} -> {:ok, value}
      _ -> :error
    end
  end

  defp maybe_convert(:hex, value, :hex) do
    case decode16(value) do
      {:ok, _} -> {:ok, value}
      _ -> :error
    end
  end

  defp maybe_convert(:int, value, int_format) when int_format in @int_formats,
    do: convert_int(value, int_format)

  defp maybe_convert(format_in, value, format_out),
    do: value |> to_raw(format_in) |> from_raw(format_out)

  # convert a value to raw format
  defp to_raw(value, from_format)
  defp to_raw(value, :raw), do: {:ok, value}
  defp to_raw(value, :url64), do: decode64(value)
  defp to_raw(value, :hex), do: decode16(value)

  defp to_raw(value, :int) do
    case convert_int(value, :signed) do
      {:ok, int} -> {:ok, <<int::signed-64>>}
      _ -> :error
    end
  end

  defp to_raw(_, :error), do: :error

  # convert a raw value to another format
  defp from_raw(raw, to_format)
  defp from_raw({:ok, raw}, :raw), do: {:ok, raw}
  defp from_raw({:ok, raw}, :url64), do: {:ok, encode64(raw)}
  defp from_raw({:ok, raw}, :hex), do: {:ok, encode16(raw)}
  defp from_raw({:ok, <<int::signed-64>>}, :signed), do: {:ok, int}
  defp from_raw({:ok, <<int::unsigned-64>>}, :unsigned), do: {:ok, int}
  defp from_raw(_, _), do: :error

  defp check_nonce_type_option(params = %{nonce_type: :encrypted, get_key: _}), do: params

  defp check_nonce_type_option(%{nonce_type: :encrypted}),
    do: raise(ArgumentError, "you must provide :get_key")

  defp check_nonce_type_option(params = %{encrypt?: true}) do
    Logger.warning("option `:encrypt?` is deprecated, use `nonce_type: :encrypted` instead")
    params |> Map.put(:nonce_type, :encrypted) |> check_nonce_type_option()
  end

  defp check_nonce_type_option(params), do: params

  defp parse_int_and(value, fun) do
    case Integer.parse(value) do
      {value, _} -> fun.(value)
      _ -> :error
    end
  end
end