class T::Props::Decorator

def add_prop_definition(prop, rules)
  override = rules.delete(:override)
  if props.include?(prop) && !override
    raise ArgumentError.new("Attempted to redefine prop #{prop.inspect} that's already defined without specifying :override => true: #{prop_rules(prop)}")
  elsif !props.include?(prop) && override
    raise ArgumentError.new("Attempted to override a prop #{prop.inspect} that doesn't already exist")
  end
  @props = @props.merge(prop => rules.freeze).freeze
end

def all_props
  props.keys
end

def clobber_getter?(child, prop)
ld.decorator.method(:prop_get).owner != method(:prop_get).owner &&
ld.instance_method(prop).source_location&.first == __FILE__)

def clobber_setter?(child, prop)
ld.decorator.method(:prop_set).owner != method(:prop_set).owner &&
ld.instance_method("#{prop}=").source_location&.first == __FILE__)

def convert_type_to_class(type)
ype
::Types::TypedArray, T::Types::FixedArray
y
::Types::TypedHash, T::Types::FixedHash

::Types::TypedSet
::Types::Union
e below unwraps our T.nilable types for T::Props if we can.
is lets us do things like specify: const T.nilable(String), foreign: Opus::DB::Model::Merchant
nil_type = T::Utils.unwrap_nilable(type)
on_nil_type
nvert_type_to_class(non_nil_type)

ject
::Types::Simple
.raw_type
is isn't allowed unless whitelisted_for_underspecification is
ue, due to the check in prop_validate_definition
ct

def decorated_class
  @class
end

def define_foreign_method(prop_name, rules, foreign)
hod = "#{prop_name}_"
 there's no clear reason *not* to allow additional options
, but we're baking in `allow_direct_mutation` since we
en't* allowed additional options in the past and want to
ult to keeping this interface narrow.
.send(:define_method, fk_method) do |allow_direct_mutation: nil|
ign = T.let(foreign, T.untyped)
oreign.is_a?(Proc)
solved_foreign = foreign.call
 !resolved_foreign.respond_to?(:load)
raise ArgumentError.new(
  "The `foreign` proc for `#{prop_name}` must return a model class. " \
  "Got `#{resolved_foreign.inspect}` instead."
)
d
`foreign` is part of the closure state, so this will persist to future invocations
of the method, optimizing it so this only runs on the first invocation.
reign = resolved_foreign
 = if allow_direct_mutation.nil?


llow_direct_mutation: allow_direct_mutation}
safe(self.class).decorator.foreign_prop_get(self, prop_name, foreign, rules, opts)
fk_method = "#{fk_method}!"
.send(:define_method, force_fk_method) do |allow_direct_mutation: nil|
ed_foreign = send(fk_method, allow_direct_mutation: allow_direct_mutation)
loaded_foreign
:Configuration.hard_assert_handler(
'Failed to load foreign model',
storytime: {method: force_fk_method, class: self.class}
ed_foreign

def define_getter_and_setter(name, rules)
figuration.without_ruby_warnings do
rules[:immutable]
 method(:prop_set).owner != T::Props::Decorator
@class.send(:define_method, "#{name}=") do |val|
  T.unsafe(self.class).decorator.prop_set(self, name, val, rules)
end
se
# Fast path (~4x faster as of Ruby 2.6)
@class.send(:define_method, "#{name}=", &rules.fetch(:setter_proc))
d
ethod(:prop_get).owner != T::Props::Decorator || rules.key?(:ifunset)
lass.send(:define_method, name) do
T.unsafe(self.class).decorator.prop_get(self, name, rules)
d

Fast path (~30x faster as of Ruby 2.6)
lass.send(:attr_reader, name) # send is used because `attr_reader` is private in 2.4

def foreign_prop_get(instance, prop, foreign_class, rules=prop_rules(prop), opts={})
  return if !(value = prop_get(instance, prop, rules))
  T.unsafe(foreign_class).load(value, {}, opts)
end

def handle_foreign_option(prop_name, prop_cls, rules, foreign)
te_foreign_option(
eign, foreign, valid_type_msg: "a model class or a Proc that returns one"
p_cls != String
e ArgumentError.new("`foreign` can only be used with a prop type of String")
eign.is_a?(Array)
 don't support arrays with `foreign` because it's hard to both preserve ordering and
ep them from being lurky performance hits by issuing a bunch of un-batched DB queries.
 could potentially address that by porting over something like AmbiguousIDLoader.
e ArgumentError.new(
sing an array for `foreign` is no longer supported. Instead, please use a union type of " \
oken types for the prop type, e.g., T.any(Opus::Autogen::Tokens::FooModelToken, Opus::Autogen::Tokens::BarModelToken)"
 foreign.is_a?(Proc)
onfiguration.soft_assert_handler(<<~MESSAGE, storytime: {prop: prop_name, value: foreign}, notify: 'jerry')
ease use a Proc that returns a model class instead of the model class itself as the argument to `foreign`. In other words:
instead of `prop :foo, String, foreign: FooModel`
use `prop :foo, String, foreign: -> {FooModel}`
AGE
_foreign_method(prop_name, rules, foreign)

def handle_redaction_option(prop_name, redaction)
ed_method = "#{prop_name}_redacted"
.send(:define_method, redacted_method) do
e = self.public_send(prop_name)
ler = T::Configuration.redaction_handler
handler
ise "Using `redaction:` on a prop requires specifying `T::Configuration.redaction_handler`"
ler.call(value, redaction)

def initialize(klass)
  @class = T.let(klass, T.all(Module, T::Props::ClassMethods))
  @class.plugins.each do |mod|
    T::Props::Plugin::Private.apply_decorator_methods(mod, self)
  end
  @props = T.let(EMPTY_PROPS, T::Hash[Symbol, Rules])
end

def model_inherited(child)
  child.extend(T::Props::ClassMethods)
  child = T.cast(child, T.all(Module, T::Props::ClassMethods))
  child.plugins.concat(decorated_class.plugins)
  decorated_class.plugins.each do |mod|
    # NB: apply_class_methods must not be an instance method on the decorator itself,
    # otherwise we'd have to call child.decorator here, which would create the decorator
    # before any `decorator_class` override has a chance to take effect (see the comment below).
    T::Props::Plugin::Private.apply_class_methods(mod, child)
  end
  props.each do |name, rules|
    copied_rules = rules.dup
    # NB: Calling `child.decorator` here is a timb bomb that's going to give someone a really bad
    # time. Any class that defines props and also overrides the `decorator_class` method is going
    # to reach this line before its override take effect, turning it into a no-op.
    child.decorator.add_prop_definition(name, copied_rules)
    # It's a bit tricky to support `prop_get` hooks added by plugins without
    # sacrificing the `attr_reader` fast path or clobbering customized getters
    # defined manually on a child.
    #
    # To make this work, we _do_ clobber getters defined on the child, but only if:
    # (a) it's needed in order to support a `prop_get` hook, and
    # (b) it's safe because the getter was defined by this file.
    #
    unless rules[:without_accessors]
      if clobber_getter?(child, name)
        child.send(:define_method, name) do
          T.unsafe(self.class).decorator.prop_get(self, name, rules)
        end
      end
      if !rules[:immutable] && clobber_setter?(child, name)
        child.send(:define_method, "#{name}=") do |val|
          T.unsafe(self.class).decorator.prop_set(self, name, val, rules)
        end
      end
    end
  end
end

def plugin(mod)
  decorated_class.plugins << mod
  T::Props::Plugin::Private.apply_class_methods(mod, decorated_class)
  T::Props::Plugin::Private.apply_decorator_methods(mod, self)
end

def prop_defined(name, cls, rules={})
  cls = T::Utils.resolve_alias(cls)
  if prop_nilable?(cls, rules)
    # :_tnilable is introduced internally for performance purpose so that clients do not need to call
    # T::Utils::Nilable.is_tnilable(cls) again.
    # It is strictly internal: clients should always use T::Props::Utils.required_prop?() or
    # T::Props::Utils.optional_prop?() for checking whether a field is required or optional.
    rules[:_tnilable] = true
  end
  name = name.to_sym
  type = cls
  if !cls.is_a?(Module)
    cls = convert_type_to_class(cls)
  end
  type_object = smart_coerce(type, enum: rules[:enum])
  prop_validate_definition!(name, cls, rules, type_object)
  # Retrive the possible underlying object with T.nilable.
  type = T::Utils::Nilable.get_underlying_type(type)
  sensitivity_and_pii = {sensitivity: rules[:sensitivity]}
  normalize = T::Configuration.normalize_sensitivity_and_pii_handler
  if normalize
    sensitivity_and_pii = normalize.call(sensitivity_and_pii)
    # We check for Class so this is only applied on concrete
    # documents/models; We allow mixins containing props to not
    # specify their PII nature, as long as every class into which they
    # are ultimately included does.
    #
    if sensitivity_and_pii[:pii] && @class.is_a?(Class) && !T.unsafe(@class).contains_pii?
      raise ArgumentError.new(
        'Cannot include a pii prop in a class that declares `contains_no_pii`'
      )
    end
  end
  rules = rules.merge(
    # TODO: The type of this element is confusing. We should refactor so that
    # it can be always `type_object` (a PropType) or always `cls` (a Module)
    type: type,
    type_object: type_object,
    accessor_key: "@#{name}".to_sym,
    sensitivity: sensitivity_and_pii[:sensitivity],
    pii: sensitivity_and_pii[:pii],
    # extra arbitrary metadata attached by the code defining this property
    extra: rules[:extra]&.freeze,
  )
  validate_not_missing_sensitivity(name, rules)
  # for backcompat (the `:array` key is deprecated but because the name is
  # so generic it's really hard to be sure it's not being relied on anymore)
  if type.is_a?(T::Types::TypedArray)
    inner = T::Utils::Nilable.get_underlying_type(type.type)
    if inner.is_a?(Module)
      rules[:array] = inner
    end
  end
  rules[:setter_proc] = T::Props::Private::SetterFactory.build_setter_proc(@class, name, rules).freeze
  add_prop_definition(name, rules)
  # NB: using `without_accessors` doesn't make much sense unless you also define some other way to
  # get at the property (e.g., Chalk::ODM::Document exposes `get` and `set`).
  define_getter_and_setter(name, rules) unless rules[:without_accessors]
  handle_foreign_option(name, cls, rules, rules[:foreign]) if rules[:foreign]
  handle_redaction_option(name, rules[:redaction]) if rules[:redaction]
end

def prop_get(instance, prop, rules=prop_rules(prop))
  val = instance.instance_variable_get(rules[:accessor_key])
  if !val.nil?
    val
  elsif (d = rules[:ifunset])
    T::Props::Utils.deep_clone_object(d)
  else
    nil
  end
end

def prop_get_if_set(instance, prop, rules=prop_rules(prop))
  instance.instance_variable_get(rules[:accessor_key])
end

def prop_get_logic(instance, prop, value)
  value
end

def prop_nilable?(cls, rules)
ls::Nilable.is_union_with_nilclass(cls) || (cls == T.untyped && rules.key?(:default) && rules[:default].nil?)

def prop_rules(prop)
  props[prop.to_sym] || raise("No such prop: #{prop.inspect}")
end

def prop_set(instance, prop, val, rules=prop_rules(prop))
  instance.instance_exec(val, &rules.fetch(:setter_proc))
end

def prop_validate_definition!(name, cls, rules, type)
  validate_prop_name(name)
  if rules.key?(:pii)
    raise ArgumentError.new("The 'pii:' option for props has been renamed " \
      "to 'sensitivity:' (in prop #{@class.name}.#{name})")
  end
  if rules.keys.any? {|k| !valid_rule_key?(k)}
    raise ArgumentError.new("At least one invalid prop arg supplied in #{self}: #{rules.keys.inspect}")
  end
  if !rules[:clobber_existing_method!] && !rules[:without_accessors] && BANNED_METHOD_NAMES.include?(name.to_sym)
    raise ArgumentError.new(
      "#{name} can't be used as a prop in #{@class} because a method with " \
      "that name already exists (defined by #{@class.instance_method(name).owner} " \
      "at #{@class.instance_method(name).source_location || '<unknown>'}). " \
      "(If using this name is unavoidable, try `without_accessors: true`.)"
    )
  end
  extra = rules[:extra]
  if !extra.nil? && !extra.is_a?(Hash)
    raise ArgumentError.new("Extra metadata must be a Hash in prop #{@class.name}.#{name}")
  end
  nil
end

def smart_coerce(type, enum:)
wards compatibility for pre-T::Types style
 T::Utils.coerce(type)
m.nil?

il_type = T::Utils.unwrap_nilable(type)
onnil_type
nilable(T.all(nonnil_type, T.deprecated_enum(enum)))

all(type, T.deprecated_enum(enum))

def valid_rule_key?(key)
  !!VALID_RULE_KEYS[key]
end

def validate_foreign_option(option_sym, foreign, valid_type_msg:)
eign.is_a?(Symbol) || foreign.is_a?(String)
e ArgumentError.new(
sing a symbol/string for `#{option_sym}` is no longer supported. Instead, use a Proc " \
hat returns the class, e.g., foreign: -> {Foo}"
reign.is_a?(Proc) && !foreign.is_a?(Array) && !foreign.respond_to?(:load)
e ArgumentError.new("The `#{option_sym}` option must be #{valid_type_msg}")

def validate_not_missing_sensitivity(prop_name, rules)
es[:sensitivity].nil?
ules[:redaction]
:Configuration.hard_assert_handler(
"#{@class}##{prop_name} has a 'redaction:' annotation but no " \
"'sensitivity:' annotation. This is probably wrong, because if a " \
"prop needs redaction then it is probably sensitive. Add a " \
"sensitivity annotation like 'sensitivity: Opus::Sensitivity::PII." \
"whatever', or explicitly override this check with 'sensitivity: []'."
DO(PRIVACYENG-982) Ideally we'd also check for 'password' and possibly
her terms, but this interacts badly with ProtoDefinedDocument because
e proto syntax currently can't declare "sensitivity: []"
\bsecret\b/.match?(prop_name)
:Configuration.hard_assert_handler(
"#{@class}##{prop_name} has the word 'secret' in its name, but no " \
"'sensitivity:' annotation. This is probably wrong, because if a " \
"prop is named 'secret' then it is probably sensitive. Add a " \
"sensitivity annotation like 'sensitivity: Opus::Sensitivity::NonPII." \
"security_token', or explicitly override this check with " \
"'sensitivity: []'."

def validate_prop_name(name)
me.match?(SAFE_NAME)
e ArgumentError.new("Invalid prop name in #{@class.name}: #{name}")

def validate_prop_value(prop, val)
  # We call `setter_proc` here without binding to an instance, so it'll run
  # `instance_variable_set` if validation passes, but nothing will care.
  # We only care about the validation.
  prop_rules(prop).fetch(:setter_proc).call(val)
end