class T::Props::Decorator

def add_prop_definition(prop, rules)
  override = rules.delete(:override)
  if props.include?(prop) && !override
    raise ArgumentError.new("Attempted to redefine prop #{prop.inspect} that's already defined without specifying :override => true: #{prop_rules(prop)}")
  elsif !props.include?(prop) && override
    raise ArgumentError.new("Attempted to override a prop #{prop.inspect} that doesn't already exist")
  end
  @props = @props.merge(prop => rules.freeze).freeze
end

def all_props; props.keys; end

def array_subdoc_type(type)
e.is_a?(T::Types::TypedArray)
ype = T::Utils.unwrap_nilable(type.type) || type.type
l_type.is_a?(T::Types::Simple) &&
(el_type.raw_type < T::Props::Serializable || el_type.raw_type.is_a?(T::Props::CustomType))
turn el_type.raw_type

def convert_type_to_class(type)
ype
::Types::TypedArray, T::Types::FixedArray
y
::Types::TypedHash, T::Types::FixedHash

::Types::TypedSet
::Types::Union
e below unwraps our T.nilable types for T::Props if we can.
is lets us do things like specify: const T.nilable(String), foreign: Opus::DB::Model::Merchant
nil_type = T::Utils.unwrap_nilable(type)
on_nil_type
nvert_type_to_class(non_nil_type)

ject
::Types::Simple
.raw_type
is isn't allowed unless whitelisted_for_underspecification is
ue, due to the check in prop_validate_definition
ct

def decorated_class; @class; end

def define_foreign_method(prop_name, rules, foreign)
hod = "#{prop_name}_"
 there's no clear reason *not* to allow additional options
, but we're baking in `allow_direct_mutation` since we
en't* allowed additional options in the past and want to
ult to keeping this interface narrow.
.send(:define_method, fk_method) do |allow_direct_mutation: nil|
ign = T.let(foreign, T.untyped)
oreign.is_a?(Proc)
solved_foreign = foreign.call
 !resolved_foreign.respond_to?(:load)
raise ArgumentError.new(
  "The `foreign` proc for `#{prop_name}` must return a model class. " \
  "Got `#{resolved_foreign.inspect}` instead."
)
d
`foreign` is part of the closure state, so this will persist to future invocations
of the method, optimizing it so this only runs on the first invocation.
reign = resolved_foreign
llow_direct_mutation.nil?
ts = {}

ts = {allow_direct_mutation: allow_direct_mutation}
safe(self.class).decorator.foreign_prop_get(self, prop_name, foreign, rules, opts)
fk_method = "#{fk_method}!"
.send(:define_method, force_fk_method) do |allow_direct_mutation: nil|
ed_foreign = send(fk_method, allow_direct_mutation: allow_direct_mutation)
loaded_foreign
:Configuration.hard_assert_handler(
'Failed to load foreign model',
storytime: {method: force_fk_method, class: self.class}
ed_foreign
.send(:define_method, "#{prop_name}_record") do |allow_direct_mutation: nil|
onfiguration.soft_assert_handler(
sing deprecated 'model.#{prop_name}_record' foreign key syntax. You should replace this with 'model.#{prop_name}_'",
tify: 'vasi'
(fk_method, allow_direct_mutation: allow_direct_mutation)

def define_getter_and_setter(name, rules)
figuration.without_ruby_warnings do
rules[:immutable]
 method(:prop_set).owner != T::Props::Decorator
@class.send(:define_method, "#{name}=") do |val|
  T.unsafe(self.class).decorator.prop_set(self, name, val, rules)
end
se
# Fast path (~4x faster as of Ruby 2.6)
@class.send(:define_method, "#{name}=", &rules.fetch(:setter_proc))
d
ethod(:prop_get).owner != T::Props::Decorator || rules.key?(:ifunset)
lass.send(:define_method, name) do
T.unsafe(self.class).decorator.prop_get(self, name, rules)
d

Fast path (~30x faster as of Ruby 2.6)
lass.send(:attr_reader, name) # send is used because `attr_reader` is private in 2.4

def foreign_prop_get(instance, prop, foreign_class, rules=props[prop.to_sym], opts={})
  return if !(value = prop_get(instance, prop, rules))
  T.unsafe(foreign_class).load(value, {}, opts)
end

def handle_foreign_hint_only_option(prop_cls, foreign_hint_only)
tring, Array].include?(prop_cls) && !(prop_cls.is_a?(T::Props::CustomType))
e ArgumentError.new(
foreign_hint_only` can only be used with String or Array prop types"
te_foreign_option(
eign_hint_only, foreign_hint_only,
d_type_msg: "an individual or array of a model class, or a Proc returning such."

def handle_foreign_option(prop_name, prop_cls, rules, foreign)
te_foreign_option(
eign, foreign, valid_type_msg: "a model class or a Proc that returns one"
p_cls != String
e ArgumentError.new("`foreign` can only be used with a prop type of String")
eign.is_a?(Array)
 don't support arrays with `foreign` because it's hard to both preserve ordering and
ep them from being lurky performance hits by issuing a bunch of un-batched DB queries.
 could potentially address that by porting over something like AmbiguousIDLoader.
e ArgumentError.new(
sing an array for `foreign` is no longer supported. Instead, use `foreign_hint_only` " \
ith an array or a Proc that returns an array, e.g., foreign_hint_only: -> {[Foo, Bar]}"
_foreign_method(prop_name, rules, foreign)

def handle_redaction_option(prop_name, redaction)
ed_method = "#{prop_name}_redacted"
.send(:define_method, redacted_method) do
e = self.public_send(prop_name)
k::Tools::RedactionUtils.redact_with_directive(
lue, redaction)

def hash_key_custom_type(type)
e.is_a?(T::Types::TypedHash)
_type = T::Utils.unwrap_nilable(type.keys) || type.keys
eys_type.is_a?(T::Types::Simple) && keys_type.raw_type.is_a?(T::Props::CustomType)
turn keys_type.raw_type

def hash_value_subdoc_type(type)
e.is_a?(T::Types::TypedHash)
es_type = T::Utils.unwrap_nilable(type.values) || type.values
alues_type.is_a?(T::Types::Simple) &&
(values_type.raw_type < T::Props::Serializable || values_type.raw_type.is_a?(T::Props::CustomType))
turn values_type.raw_type

def initialize(klass)
  @class = T.let(klass, T.all(Module, T::Props::ClassMethods))
  @class.plugins.each do |mod|
    T::Props::Plugin::Private.apply_decorator_methods(mod, self)
  end
  @props = T.let(EMPTY_PROPS, T::Hash[Symbol, Rules])
end

def model_inherited(child)
  child.extend(T::Props::ClassMethods)
  child = T.cast(child, T.all(Module, T::Props::ClassMethods))
  child.plugins.concat(decorated_class.plugins)
  decorated_class.plugins.each do |mod|
    # NB: apply_class_methods must not be an instance method on the decorator itself,
    # otherwise we'd have to call child.decorator here, which would create the decorator
    # before any `decorator_class` override has a chance to take effect (see the comment below).
    T::Props::Plugin::Private.apply_class_methods(mod, child)
  end
  props.each do |name, rules|
    copied_rules = rules.dup
    # NB: Calling `child.decorator` here is a timb bomb that's going to give someone a really bad
    # time. Any class that defines props and also overrides the `decorator_class` method is going
    # to reach this line before its override take effect, turning it into a no-op.
    child.decorator.add_prop_definition(name, copied_rules)
    # It's a bit tricky to support `prop_get` hooks added by plugins without
    # sacrificing the `attr_reader` fast path or clobbering customized getters
    # defined manually on a child.
    #
    # To make this work, we _do_ clobber getters defined on the child, but only if:
    # (a) it's needed in order to support a `prop_get` hook, and
    # (b) it's safe because the getter was defined by this file.
    #
    unless rules[:without_accessors]
      if child.decorator.method(:prop_get).owner != method(:prop_get).owner &&
          child.instance_method(name).source_location&.first == __FILE__
        child.send(:define_method, name) do
          T.unsafe(self.class).decorator.prop_get(self, name, rules)
        end
      end
      unless rules[:immutable]
        if child.decorator.method(:prop_set).owner != method(:prop_set).owner &&
            child.instance_method("#{name}=").source_location&.first == __FILE__
          child.send(:define_method, "#{name}=") do |val|
            T.unsafe(self.class).decorator.prop_set(self, name, val, rules)
          end
        end
      end
    end
  end
end

def plugin(mod)
  decorated_class.plugins << mod
  T::Props::Plugin::Private.apply_class_methods(mod, decorated_class)
  T::Props::Plugin::Private.apply_decorator_methods(mod, self)
end

def prop_defined(name, cls, rules={})
  cls = T::Utils.resolve_alias(cls)
  if rules[:optional] == true
    T::Configuration.hard_assert_handler(
      'Use of `optional: true` is deprecated, please use `T.nilable(...)` instead.',
      storytime: {
        name: name,
        cls_or_args: cls.to_s,
        args: rules,
        klass: decorated_class.name,
      },
    )
  elsif rules[:optional] == false
    T::Configuration.hard_assert_handler(
      'Use of `optional: :false` is deprecated as it\'s the default value.',
      storytime: {
        name: name,
        cls_or_args: cls.to_s,
        args: rules,
        klass: decorated_class.name,
      },
    )
  elsif rules[:optional] == :on_load
    T::Configuration.hard_assert_handler(
      'Use of `optional: :on_load` is deprecated. You probably want `T.nilable(...)` with :raise_on_nil_write instead.',
      storytime: {
        name: name,
        cls_or_args: cls.to_s,
        args: rules,
        klass: decorated_class.name,
      },
    )
  elsif rules[:optional] == :existing
    T::Configuration.hard_assert_handler(
      'Use of `optional: :existing` is not allowed: you should use use T.nilable (http://go/optional)',
      storytime: {
        name: name,
        cls_or_args: cls.to_s,
        args: rules,
        klass: decorated_class.name,
      },
    )
  end
  if T::Utils::Nilable.is_union_with_nilclass(cls)
    # :_tnilable is introduced internally for performance purpose so that clients do not need to call
    # T::Utils::Nilable.is_tnilable(cls) again.
    # It is strictly internal: clients should always use T::Props::Utils.required_prop?() or
    # T::Props::Utils.optional_prop?() for checking whether a field is required or optional.
    rules[:_tnilable] = true
  end
  name = name.to_sym
  type = cls
  if !cls.is_a?(Module)
    cls = convert_type_to_class(cls)
  end
  type_object = type
  if !(type_object.singleton_class < T::Props::CustomType)
    type_object = smart_coerce(type_object, array: rules[:array], enum: rules[:enum])
  end
  prop_validate_definition!(name, cls, rules, type_object)
  # Retrive the possible underlying object with T.nilable.
  underlying_type_object = T::Utils::Nilable.get_underlying_type_object(type_object)
  type = T::Utils::Nilable.get_underlying_type(type)
  array_subdoc_type = array_subdoc_type(underlying_type_object)
  hash_value_subdoc_type = hash_value_subdoc_type(underlying_type_object)
  hash_key_custom_type = hash_key_custom_type(underlying_type_object)
  sensitivity_and_pii = {sensitivity: rules[:sensitivity]}
  if defined?(Opus) && defined?(Opus::Sensitivity) && defined?(Opus::Sensitivity::Utils)
    sensitivity_and_pii = Opus::Sensitivity::Utils.normalize_sensitivity_and_pii_annotation(sensitivity_and_pii)
  end
  # We check for Class so this is only applied on concrete
  # documents/models; We allow mixins containing props to not
  # specify their PII nature, as long as every class into which they
  # are ultimately included does.
  #
  if defined?(Opus) && defined?(Opus::Sensitivity) && defined?(Opus::Sensitivity::PIIable)
    if sensitivity_and_pii[:pii] && @class.is_a?(Class) && !T.unsafe(@class).contains_pii?
      raise ArgumentError.new(
        'Cannot include a pii prop in a class that declares `contains_no_pii`'
      )
    end
  end
  needs_clone =
    if cls <= Array || cls <= Hash || cls <= Set
      shallow_clone_ok(underlying_type_object) ? :shallow : true
    else
      false
    end
  rules = rules.merge(
    # TODO: The type of this element is confusing. We should refactor so that
    # it can be always `type_object` (a PropType) or always `cls` (a Module)
    type: type,
    # These are precomputed for performance
    # TODO: A lot of these are only needed by T::Props::Serializable or T::Struct
    # and can/should be moved accordingly.
    type_is_custom_type: cls.singleton_class < T::Props::CustomType,
    type_is_serializable: cls < T::Props::Serializable,
    type_is_array_of_serializable: !array_subdoc_type.nil?,
    type_is_hash_of_serializable_values: !hash_value_subdoc_type.nil?,
    type_is_hash_of_custom_type_keys: !hash_key_custom_type.nil?,
    type_object: type_object,
    type_needs_clone: needs_clone,
    accessor_key: "@#{name}".to_sym,
    sensitivity: sensitivity_and_pii[:sensitivity],
    pii: sensitivity_and_pii[:pii],
    # extra arbitrary metadata attached by the code defining this property
    extra: rules[:extra]&.freeze,
  )
  validate_not_missing_sensitivity(name, rules)
  # for backcompat
  if type.is_a?(T::Types::TypedArray) && type.type.is_a?(T::Types::Simple)
    rules[:array] = type.type.raw_type
  elsif array_subdoc_type
    rules[:array] = array_subdoc_type
  end
  if rules[:type_is_serializable]
    rules[:serializable_subtype] = cls
  elsif array_subdoc_type
    rules[:serializable_subtype] = array_subdoc_type
  elsif hash_value_subdoc_type && hash_key_custom_type
    rules[:serializable_subtype] = {
      keys: hash_key_custom_type,
      values: hash_value_subdoc_type,
    }
  elsif hash_value_subdoc_type
    rules[:serializable_subtype] = hash_value_subdoc_type
  elsif hash_key_custom_type
    rules[:serializable_subtype] = hash_key_custom_type
  end
  rules[:setter_proc] = T::Props::Private::SetterFactory.build_setter_proc(@class, name, rules).freeze
  add_prop_definition(name, rules)
  # NB: using `without_accessors` doesn't make much sense unless you also define some other way to
  # get at the property (e.g., Chalk::ODM::Document exposes `get` and `set`).
  define_getter_and_setter(name, rules) unless rules[:without_accessors]
  if rules[:foreign] && rules[:foreign_hint_only]
    raise ArgumentError.new(":foreign and :foreign_hint_only are mutually exclusive.")
  end
  handle_foreign_option(name, cls, rules, rules[:foreign]) if rules[:foreign]
  handle_foreign_hint_only_option(cls, rules[:foreign_hint_only]) if rules[:foreign_hint_only]
  handle_redaction_option(name, rules[:redaction]) if rules[:redaction]
end

def prop_get(instance, prop, rules=prop_rules(prop))
  val = instance.instance_variable_get(rules[:accessor_key])
  if !val.nil?
    val
  else
    if (d = rules[:ifunset])
      T::Props::Utils.deep_clone_object(d)
    else
      nil
    end
  end
end

def prop_get_if_set(instance, prop, rules=prop_rules(prop))
  instance.instance_variable_get(rules[:accessor_key])
end

def prop_rules(prop); props[prop.to_sym] || raise("No such prop: #{prop.inspect}"); end

def prop_set(instance, prop, val, rules=prop_rules(prop))
  instance.instance_exec(val, &rules.fetch(:setter_proc))
end

def prop_validate_definition!(name, cls, rules, type)
  validate_prop_name(name)
  if rules.key?(:pii)
    raise ArgumentError.new("The 'pii:' option for props has been renamed " \
      "to 'sensitivity:' (in prop #{@class.name}.#{name})")
  end
  if rules.keys.any? {|k| !valid_rule_key?(k)}
    raise ArgumentError.new("At least one invalid prop arg supplied in #{self}: #{rules.keys.inspect}")
  end
  if (array = rules[:array])
    unless array.is_a?(Module)
      raise ArgumentError.new("Bad class as subtype in prop #{@class.name}.#{name}: #{array.inspect}")
    end
  end
  if !(rules[:clobber_existing_method!]) && !(rules[:without_accessors])
    if BANNED_METHOD_NAMES.include?(name.to_sym)
      raise ArgumentError.new(
        "#{name} can't be used as a prop in #{@class} because a method with " \
        "that name already exists (defined by #{@class.instance_method(name).owner} " \
        "at #{@class.instance_method(name).source_location || '<unknown>'}). " \
        "(If using this name is unavoidable, try `without_accessors: true`.)"
      )
    end
  end
  extra = rules[:extra]
  if !extra.nil? && !extra.is_a?(Hash)
    raise ArgumentError.new("Extra metadata must be a Hash in prop #{@class.name}.#{name}")
  end
  nil
end

def shallow_clone_ok(type)
type =
ype.is_a?(T::Types::TypedArray)
pe.type
f type.is_a?(T::Types::TypedSet)
pe.type
f type.is_a?(T::Types::TypedHash)
pe.values
type.is_a?(T::Types::Simple) && TYPES_NOT_NEEDING_CLONE.any? do |cls|
r_type.raw_type <= cls

def smart_coerce(type, array:, enum:)
wards compatibility for pre-T::Types style
ray.nil? && !enum.nil?
e ArgumentError.new("Cannot specify both :array and :enum options")
!array.nil?
ype == Set
:Set[array]

:Array[array]
!enum.nil?
::Utils.unwrap_nilable(type)
nilable(T.enum(enum))

enum(enum)
tils.coerce(type)

def valid_rule_key?(key)
  !!VALID_RULE_KEYS[key]
end

def validate_foreign_option(option_sym, foreign, valid_type_msg:)
eign.is_a?(Symbol) || foreign.is_a?(String)
e ArgumentError.new(
sing a symbol/string for `#{option_sym}` is no longer supported. Instead, use a Proc " \
hat returns the class, e.g., foreign: -> {Foo}"
reign.is_a?(Proc) && !foreign.is_a?(Array) && !foreign.respond_to?(:load)
e ArgumentError.new("The `#{option_sym}` option must be #{valid_type_msg}")

def validate_not_missing_sensitivity(prop_name, rules)
es[:sensitivity].nil?
ules[:redaction]
:Configuration.hard_assert_handler(
"#{@class}##{prop_name} has a 'redaction:' annotation but no " \
"'sensitivity:' annotation. This is probably wrong, because if a " \
"prop needs redaction then it is probably sensitive. Add a " \
"sensitivity annotation like 'sensitivity: Opus::Sensitivity::PII." \
"whatever', or explicitly override this check with 'sensitivity: []'."
DO(PRIVACYENG-982) Ideally we'd also check for 'password' and possibly
her terms, but this interacts badly with ProtoDefinedDocument because
e proto syntax currently can't declare "sensitivity: []"
rop_name =~ /\bsecret\b/
:Configuration.hard_assert_handler(
"#{@class}##{prop_name} has the word 'secret' in its name, but no " \
"'sensitivity:' annotation. This is probably wrong, because if a " \
"prop is named 'secret' then it is probably sensitive. Add a " \
"sensitivity annotation like 'sensitivity: Opus::Sensitivity::NonPII." \
"security_token', or explicitly override this check with " \
"'sensitivity: []'."

def validate_prop_name(name)
me.match?(/\A[A-Za-z_][A-Za-z0-9_-]*\z/)
e ArgumentError.new("Invalid prop name in #{@class.name}: #{name}")

def validate_prop_value(prop, val)
  # We call `setter_proc` here without binding to an instance, so it'll run
  # `instance_variable_set` if validation passes, but nothing will care.
  # We only care about the validation.
  prop_rules(prop).fetch(:setter_proc).call(val)
end