<?php
/**
 * Streaming SQL statement splitter.
 *
 * Fed arbitrary blocks of bytes, it yields complete statements. It understands single and
 * double quotes (backslash escapes and doubled quotes), backticks, "-- " and "#" line
 * comments, block comments (/*! executable comments are kept as statement text) and
 * DELIMITER lines. A block boundary can fall anywhere, even inside an escape sequence
 * or a multibyte character: the splitter waits for more input when it needs lookahead.
 *
 * It replaces the old approach of splitting on ";\n", which broke any content containing
 * a semicolon at the end of a line.
 *
 * @package AccessNow\Replica
 */

namespace AccessNow\Replica\Db;

defined( 'ABSPATH' ) || exit;

// Exception messages are plain text: they are escaped where shown (esc_html() in PHP, textContent in admin.js).
// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped

/**
 * Statement splitter.
 */
final class Sql_Splitter {

	const N     = 0; // Normal.
	const SQ    = 1; // Inside '...'.
	const DQ    = 2; // Inside "...".
	const BT    = 3; // Inside `...`.
	const LINE  = 4; // Inside a line comment.
	const BLOCK = 5; // Inside a block comment.

	/**
	 * Unprocessed input.
	 *
	 * @var string
	 */
	private $buf = '';

	/**
	 * Scan position in $buf.
	 *
	 * @var int
	 */
	private $pos = 0;

	/**
	 * Start of the current statement in $buf.
	 *
	 * @var int
	 */
	private $start = 0;

	/**
	 * Lexer mode.
	 *
	 * @var int
	 */
	private $mode = self::N;

	/**
	 * Statement delimiter.
	 *
	 * @var string
	 */
	private $delim = ';';

	/**
	 * Safety limit for one statement.
	 *
	 * @var int
	 */
	private $max;

	/**
	 * Creates a splitter.
	 *
	 * @param int $max Max statement bytes.
	 */
	public function __construct( $max = 67108864 ) {
		$this->max = (int) $max;
	}

	/**
	 * Feeds bytes; returns the statements completed so far.
	 *
	 * @param string $bytes Input.
	 * @param bool   $final No more input will follow.
	 * @return string[]
	 * @throws \RuntimeException On unterminated input or oversized statements.
	 */
	public function feed( $bytes, $final = false ) {
		$this->buf .= $bytes;
		$out        = array();
		$len        = strlen( $this->buf );
		$stops      = "'\"`#-/" . $this->delim[0];

		while ( $this->pos < $len ) {
			switch ( $this->mode ) {
				case self::N:
					// DELIMITER lines only matter at the very start of a statement.
					if ( $this->pos === $this->start ) {
						$ws = strspn( $this->buf, " \t\r\n", $this->pos );
						if ( $this->pos + $ws >= $len && ! $final ) {
							break 2; // Only whitespace so far: wait for more.
						}
						$line_end = strpos( $this->buf, "\n", $this->pos + $ws );
						if ( false === $line_end && ! $final && 0 === strncasecmp( substr( $this->buf, $this->pos + $ws, 9 ), 'DELIMITER', min( 9, $len - $this->pos - $ws ) ) ) {
							break 2; // Might be a DELIMITER line: need all of it.
						}
						if ( preg_match( '/\G\s*DELIMITER\s+(\S+)[ \t]*(\r?\n|$)/i', $this->buf, $m, 0, $this->pos ) ) {
							$this->delim = $m[1];
							$stops       = "'\"`#-/" . $this->delim[0];
							$this->pos  += strlen( $m[0] );
							$this->start = $this->pos;
							continue 2;
						}
						$this->pos  += $ws;
						$this->start = $this->pos;
						if ( $this->pos >= $len ) {
							break 2;
						}
					}
					$this->pos += strcspn( $this->buf, $stops, $this->pos );
					if ( $this->pos >= $len ) {
						break 2;
					}
					$c = $this->buf[ $this->pos ];
					if ( "'" === $c ) {
						$this->mode = self::SQ;
						++$this->pos;
					} elseif ( '"' === $c ) {
						$this->mode = self::DQ;
						++$this->pos;
					} elseif ( '`' === $c ) {
						$this->mode = self::BT;
						++$this->pos;
					} elseif ( '#' === $c ) {
						$this->mode = self::LINE;
						++$this->pos;
					} elseif ( '-' === $c ) {
						if ( $this->pos + 2 >= $len && ! $final ) {
							break 2; // Need lookahead.
						}
						$next = substr( $this->buf, $this->pos + 1, 2 );
						if ( '-' === ( $next[0] ?? '' ) && ( ! isset( $next[1] ) || ctype_space( $next[1] ) ) ) {
							$this->mode = self::LINE;
							$this->pos += 2;
						} else {
							++$this->pos;
						}
					} elseif ( '/' === $c ) {
						if ( $this->pos + 1 >= $len && ! $final ) {
							break 2;
						}
						if ( '*' === ( $this->buf[ $this->pos + 1 ] ?? '' ) ) {
							$this->mode = self::BLOCK;
							$this->pos += 2;
						} else {
							++$this->pos;
						}
					} elseif ( substr( $this->buf, $this->pos, strlen( $this->delim ) ) === $this->delim ) {
						$stmt = trim( substr( $this->buf, $this->start, $this->pos - $this->start ) );
						if ( '' !== $stmt && ! self::only_comments( $stmt ) ) {
							$out[] = $stmt;
						}
						$this->pos  += strlen( $this->delim );
						$this->start = $this->pos;
					} elseif ( $this->pos + strlen( $this->delim ) > $len && ! $final ) {
						break 2; // Could be the start of a multi-character delimiter.
					} else {
						++$this->pos;
					}
					break;

				case self::SQ:
				case self::DQ:
				case self::BT:
					$q          = self::SQ === $this->mode ? "'" : ( self::DQ === $this->mode ? '"' : '`' );
					$this->pos += strcspn( $this->buf, self::BT === $this->mode ? '`' : $q . '\\', $this->pos );
					if ( $this->pos >= $len ) {
						break 2;
					}
					if ( '\\' === $this->buf[ $this->pos ] ) {
						if ( $this->pos + 1 >= $len && ! $final ) {
							break 2;
						}
						$this->pos += 2;
						break;
					}
					// Closing quote, unless doubled ('' "" ``).
					if ( $this->pos + 1 >= $len && ! $final ) {
						break 2;
					}
					if ( ( $this->buf[ $this->pos + 1 ] ?? '' ) === $q ) {
						$this->pos += 2;
					} else {
						$this->mode = self::N;
						++$this->pos;
					}
					break;

				case self::LINE:
					$nl = strpos( $this->buf, "\n", $this->pos );
					if ( false === $nl ) {
						$this->pos = $len;
						break 2;
					}
					$this->pos  = $nl + 1;
					$this->mode = self::N;
					break;

				case self::BLOCK:
					$end = strpos( $this->buf, '*/', $this->pos );
					if ( false === $end ) {
						$this->pos = max( $this->pos, $len - 1 );
						break 2;
					}
					$this->pos  = $end + 2;
					$this->mode = self::N;
					break;
			}

			if ( $this->pos - $this->start > $this->max ) {
				throw new \RuntimeException( 'A SQL statement is larger than ' . size_format( $this->max ) . '.' );
			}
		}

		// Drop consumed input so memory stays bounded.
		if ( $this->start > 1048576 || $this->start === $len ) {
			$this->buf    = (string) substr( $this->buf, $this->start );
			$this->pos   -= $this->start;
			$this->start  = 0;
		}

		if ( $final ) {
			if ( ! in_array( $this->mode, array( self::N, self::LINE ), true ) ) {
				throw new \RuntimeException( 'The SQL ends inside a quoted string or comment.' );
			}
			$rest = trim( substr( $this->buf, $this->start ) );
			if ( '' !== $rest && ! self::only_comments( $rest ) ) {
				$out[] = $rest;
			}
			$this->buf   = '';
			$this->pos   = 0;
			$this->start = 0;
		}
		return $out;
	}

	/**
	 * Whether text is only comments and whitespace (not executable /*! comments).
	 *
	 * @param string $sql Text.
	 */
	private static function only_comments( $sql ) {
		// A statement that starts with code is never only comments. This also keeps the regex
		// below off large INSERTs, where it can hit PCRE's backtrack limit (for example with
		// "/*" inside quoted data) and return null, which once dropped whole statements.
		$first = substr( ltrim( $sql ), 0, 1 );
		if ( '' === $first ) {
			return true;
		}
		if ( '/' !== $first && '-' !== $first && '#' !== $first ) {
			return false;
		}
		$stripped = preg_replace( '~/\*(?!!).*?\*/|--[ \t][^\n]*|#[^\n]*~s', '', $sql );
		if ( null === $stripped ) {
			return false; // Can't tell: keep it (the database will reject it if it really is empty).
		}
		return '' === trim( $stripped );
	}
}