package query

import (
	"fmt"
	"strings"
)

// ValidateSelectSQL ensures the statement looks like a single SELECT / WITH ... SELECT.
// Intentionally avoids a full SQL parser so Athena-specific syntax remains usable.
func ValidateSelectSQL(sql string) error {
	sql = strings.TrimSpace(sql)
	if sql == "" {
		return fmt.Errorf("sql is required")
	}
	// Disallow multi-statement payloads.
	trimmed := strings.TrimSuffix(strings.TrimSpace(sql), ";")
	if strings.Contains(trimmed, ";") {
		return fmt.Errorf("multiple statements are not allowed")
	}
	upper := strings.ToUpper(strings.TrimSpace(trimmed))
	if !strings.HasPrefix(upper, "SELECT") && !strings.HasPrefix(upper, "WITH") {
		return fmt.Errorf("only SELECT statements are allowed")
	}
	return nil
}

// forbiddenSQLFragments is a defense-in-depth denylist for Athena-dangerous keywords.
var forbiddenSQLFragments = []string{
	" insert ", " update ", " delete ", " drop ", " create ", " alter ",
	" truncate ", " grant ", " revoke ", " unload ", " msck ", " vacuum ",
	" optimize ", " merge ", " call ", " execute ",
}

func RejectDangerousSQL(sql string) error {
	normalized := " " + strings.ToLower(sql) + " "
	for _, frag := range forbiddenSQLFragments {
		if strings.Contains(normalized, frag) {
			return fmt.Errorf("sql contains forbidden keyword")
		}
	}
	return nil
}