sam-api/app/Http/Requests/Api/V1/Design/BomConditionRuleFormRequest.php

<?php

namespace App\Http\Requests\Api\V1\Design;

use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
use App\Models\Design\ModelParameter;
use App\Models\Product;
use App\Models\Material;

class BomConditionRuleFormRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     */
    public function authorize(): bool
    {
        return true; // Authorization handled by middleware
    }

    /**
     * Get the validation rules that apply to the request.
     */
    public function rules(): array
    {
        $modelId = $this->route('modelId');
        $ruleId = $this->route('ruleId');

        $rules = [
            'rule_name' => [
                'required',
                'string',
                'max:100',
                Rule::unique('bom_condition_rules')
                    ->where('model_id', $modelId)
                    ->where('tenant_id', auth()->user()?->currentTenant?->id)
                    ->whereNull('deleted_at')
            ],
            'condition_expression' => ['required', 'string', 'max:1000'],
            'action_type' => ['required', 'string', 'in:INCLUDE,EXCLUDE,MODIFY_QUANTITY'],
            'target_type' => ['required', 'string', 'in:MATERIAL,PRODUCT'],
            'target_id' => ['required', 'integer', 'min:1'],
            'quantity_multiplier' => ['nullable', 'numeric', 'min:0'],
            'is_active' => ['boolean'],
            'priority' => ['integer', 'min:0'],
            'description' => ['nullable', 'string', 'max:500'],
        ];

        // For update requests, ignore current record in unique validation
        if ($ruleId) {
            $rules['rule_name'][3] = $rules['rule_name'][3]->ignore($ruleId);
        }

        return $rules;
    }

    /**
     * Get custom messages for validator errors.
     */
    public function messages(): array
    {
        return [
            'rule_name.required' => '규칙 이름은 필수입니다.',
            'rule_name.unique' => '해당 모델에 이미 동일한 규칙 이름이 존재합니다.',
            'condition_expression.required' => '조건 표현식은 필수입니다.',
            'condition_expression.max' => '조건 표현식은 1000자를 초과할 수 없습니다.',
            'action_type.required' => '액션 타입은 필수입니다.',
            'action_type.in' => '액션 타입은 INCLUDE, EXCLUDE, MODIFY_QUANTITY 중 하나여야 합니다.',
            'target_type.required' => '대상 타입은 필수입니다.',
            'target_type.in' => '대상 타입은 MATERIAL 또는 PRODUCT여야 합니다.',
            'target_id.required' => '대상 ID는 필수입니다.',
            'target_id.min' => '대상 ID는 1 이상이어야 합니다.',
            'quantity_multiplier.numeric' => '수량 배수는 숫자여야 합니다.',
            'quantity_multiplier.min' => '수량 배수는 0 이상이어야 합니다.',
            'priority.min' => '우선순위는 0 이상이어야 합니다.',
            'description.max' => '설명은 500자를 초과할 수 없습니다.',
        ];
    }

    /**
     * Get custom attribute names for validator errors.
     */
    public function attributes(): array
    {
        return [
            'rule_name' => '규칙 이름',
            'condition_expression' => '조건 표현식',
            'action_type' => '액션 타입',
            'target_type' => '대상 타입',
            'target_id' => '대상 ID',
            'quantity_multiplier' => '수량 배수',
            'is_active' => '활성 상태',
            'priority' => '우선순위',
            'description' => '설명',
        ];
    }

    /**
     * Prepare the data for validation.
     */
    protected function prepareForValidation(): void
    {
        $this->merge([
            'is_active' => $this->boolean('is_active', true),
            'priority' => $this->integer('priority', 0),
        ]);

        // Set default quantity_multiplier for actions that require it
        if ($this->input('action_type') === 'MODIFY_QUANTITY' && !$this->has('quantity_multiplier')) {
            $this->merge(['quantity_multiplier' => 1.0]);
        }

        // Clean up condition expression
        if ($this->has('condition_expression')) {
            $expression = preg_replace('/\s+/', ' ', trim($this->input('condition_expression')));
            $this->merge(['condition_expression' => $expression]);
        }
    }

    /**
     * Configure the validator instance.
     */
    public function withValidator($validator)
    {
        $validator->after(function ($validator) {
            $this->validateConditionExpression($validator);
            $this->validateTargetExists($validator);
            $this->validateActionRequirements($validator);
        });
    }

    /**
     * Validate condition expression syntax and variables.
     */
    private function validateConditionExpression($validator): void
    {
        $expression = $this->input('condition_expression');

        if (!$expression) {
            return;
        }

        // Check for potentially dangerous characters or functions
        $dangerousPatterns = [
            '/\b(eval|exec|system|shell_exec|passthru|file_get_contents|file_put_contents|fopen|fwrite)\b/i',
            '/[;{}]/', // Semicolons and braces
            '/\$[a-zA-Z_]/', // PHP variables
            '/\bfunction\s*\(/i', // Function definitions
        ];

        foreach ($dangerousPatterns as $pattern) {
            if (preg_match($pattern, $expression)) {
                $validator->errors()->add('condition_expression', '조건 표현식에 허용되지 않는 문자나 함수가 포함되어 있습니다.');
                return;
            }
        }

        // Validate condition expression format
        if (!$this->isValidConditionExpression($expression)) {
            $validator->errors()->add('condition_expression', '조건 표현식의 형식이 올바르지 않습니다.');
            return;
        }

        // Validate variables in expression exist as parameters
        $this->validateConditionVariables($validator, $expression);
    }

    /**
     * Check if condition expression has valid syntax.
     */
    private function isValidConditionExpression(string $expression): bool
    {
        // Allow comparison operators, logical operators, variables, numbers, strings
        $patterns = [
            '/^.*(==|!=|>=|<=|>|<|\sIN\s|\sNOT\sIN\s|\sAND\s|\sOR\s).*$/i',
            '/^(true|false|[0-9]+)$/i', // Simple boolean or number
        ];

        foreach ($patterns as $pattern) {
            if (preg_match($pattern, $expression)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Validate that variables in condition exist as model parameters.
     */
    private function validateConditionVariables($validator, string $expression): void
    {
        $modelId = $this->route('modelId');

        // Extract variable names from expression (exclude operators and values)
        preg_match_all('/\b[a-zA-Z][a-zA-Z0-9_]*\b/', $expression, $matches);
        $variables = $matches[0];

        // Remove logical operators and reserved words
        $reservedWords = ['AND', 'OR', 'IN', 'NOT', 'TRUE', 'FALSE', 'true', 'false'];
        $variables = array_diff($variables, $reservedWords);

        if (empty($variables)) {
            return;
        }

        // Get existing parameters for this model
        $existingParameters = ModelParameter::where('model_id', $modelId)
            ->where('tenant_id', auth()->user()?->currentTenant?->id)
            ->whereNull('deleted_at')
            ->pluck('parameter_name')
            ->toArray();

        // Check for undefined variables
        $undefinedVariables = array_diff($variables, $existingParameters);

        if (!empty($undefinedVariables)) {
            $validator->errors()->add('condition_expression',
                '조건식에 정의되지 않은 변수가 사용되었습니다: ' . implode(', ', $undefinedVariables)
            );
        }
    }

    /**
     * Validate that the target (MATERIAL or PRODUCT) exists.
     */
    private function validateTargetExists($validator): void
    {
        $targetType = $this->input('target_type');
        $targetId = $this->input('target_id');

        if (!$targetType || !$targetId) {
            return;
        }

        $tenantId = auth()->user()?->currentTenant?->id;

        switch ($targetType) {
            case 'MATERIAL':
                $exists = Material::where('id', $targetId)
                    ->where('tenant_id', $tenantId)
                    ->whereNull('deleted_at')
                    ->exists();

                if (!$exists) {
                    $validator->errors()->add('target_id', '지정된 자재가 존재하지 않습니다.');
                }
                break;

            case 'PRODUCT':
                $exists = Product::where('id', $targetId)
                    ->where('tenant_id', $tenantId)
                    ->whereNull('deleted_at')
                    ->exists();

                if (!$exists) {
                    $validator->errors()->add('target_id', '지정된 제품이 존재하지 않습니다.');
                }
                break;
        }
    }

    /**
     * Validate action-specific requirements.
     */
    private function validateActionRequirements($validator): void
    {
        $actionType = $this->input('action_type');
        $quantityMultiplier = $this->input('quantity_multiplier');

        switch ($actionType) {
            case 'MODIFY_QUANTITY':
                // MODIFY_QUANTITY action requires quantity_multiplier
                if ($quantityMultiplier === null || $quantityMultiplier === '') {
                    $validator->errors()->add('quantity_multiplier', 'MODIFY_QUANTITY 액션에는 수량 배수가 필요합니다.');
                } elseif ($quantityMultiplier <= 0) {
                    $validator->errors()->add('quantity_multiplier', 'MODIFY_QUANTITY 액션의 수량 배수는 0보다 커야 합니다.');
                }
                break;

            case 'INCLUDE':
                // INCLUDE action can optionally have quantity_multiplier (default to 1)
                if ($quantityMultiplier !== null && $quantityMultiplier <= 0) {
                    $validator->errors()->add('quantity_multiplier', 'INCLUDE 액션의 수량 배수는 0보다 커야 합니다.');
                }
                break;

            case 'EXCLUDE':
                // EXCLUDE action doesn't need quantity_multiplier
                if ($quantityMultiplier !== null) {
                    $validator->errors()->add('quantity_multiplier', 'EXCLUDE 액션에는 수량 배수가 필요하지 않습니다.');
                }
                break;
        }
    }
}