// limits.mbt — Resource limits for moon-content-disposition.
//
// Content-Disposition header values are external, untrusted input. A
// hostile or buggy sender can produce multi-megabyte headers, hundreds of
// parameters, or extremely long values. Every public parser accepts a
// `Limits` value that bounds how much work a single parse may do. When a
// limit is exceeded the parser returns
// `DispositionErrorKind::LimitExceeded`; it never panics, never loops
// forever, and never silently truncates.
//
// Three presets are provided:
//   - `default()`    — generous, safe for normal use.
//   - `strict()`     — tight, for constrained deployments where every byte
//     counts.
//   - `permissive()` — large, for batch processing of known-good input.

///|
/// Bounds applied while parsing or generating Content-Disposition data.
pub struct Limits {
  max_input_bytes : Int
  max_parameters : Int
  max_parameter_name_bytes : Int
  max_parameter_value_bytes : Int
  max_filename_bytes : Int
  max_extended_value_bytes : Int
  max_context_bytes : Int
}

///|
/// Default limits. Intended for interactive and typical server use.
pub fn Limits::default() -> Limits {
  {
    max_input_bytes: 1 << 20,
    max_parameters: 256,
    max_parameter_name_bytes: 256,
    max_parameter_value_bytes: 8192,
    max_filename_bytes: 1024,
    max_extended_value_bytes: 8192,
    max_context_bytes: 80,
  }
}

///|
/// Strict limits. Intended for constrained deployments that expect small,
/// well-formed headers.
pub fn Limits::strict() -> Limits {
  {
    max_input_bytes: 16 * 1024,
    max_parameters: 32,
    max_parameter_name_bytes: 64,
    max_parameter_value_bytes: 1024,
    max_filename_bytes: 255,
    max_extended_value_bytes: 1024,
    max_context_bytes: 80,
  }
}

///|
/// Permissive limits. Intended for batch processing of trusted data with
/// very large headers.
pub fn Limits::permissive() -> Limits {
  {
    max_input_bytes: 64 << 20,
    max_parameters: 4096,
    max_parameter_name_bytes: 1024,
    max_parameter_value_bytes: 4 << 20,
    max_filename_bytes: 8192,
    max_extended_value_bytes: 4 << 20,
    max_context_bytes: 160,
  }
}

///|
/// The input byte bound.
pub fn Limits::max_input_bytes(self : Limits) -> Int {
  self.max_input_bytes
}

///|
/// The parameter count bound.
pub fn Limits::max_parameters(self : Limits) -> Int {
  self.max_parameters
}

///|
/// The parameter name byte bound.
pub fn Limits::max_parameter_name_bytes(self : Limits) -> Int {
  self.max_parameter_name_bytes
}

///|
/// The plain parameter value byte bound.
pub fn Limits::max_parameter_value_bytes(self : Limits) -> Int {
  self.max_parameter_value_bytes
}

///|
/// The filename byte bound, used by the resolver, the policy and the
/// generator.
pub fn Limits::max_filename_bytes(self : Limits) -> Int {
  self.max_filename_bytes
}

///|
/// The RFC 8187 extended value byte bound.
pub fn Limits::max_extended_value_bytes(self : Limits) -> Int {
  self.max_extended_value_bytes
}

///|
/// The error context excerpt bound.
pub fn Limits::max_context_bytes(self : Limits) -> Int {
  self.max_context_bytes
}

///|
/// The context excerpt bound used when building error messages. This is a
/// module-level convenience returning the `default()` limit so that
/// callers that construct errors directly do not need to thread a `Limits`
/// value.
pub fn max_context_bytes() -> Int {
  80
}