package validator

import (
	"fmt"
	"strings"

	"browser.local/platform/domain"
)

const (
	maxAuditSummaryLength      = 512
	maxContactNoteLength       = 160
	maxMarketplaceKeywordSize  = 80
	maxMarketplaceListSize     = 500
	maxPluginDescriptionLength = 240
	maxPluginPageTitleLength   = 40
	maxPluginBridgePayloadKeys = 16
	maxPluginBridgePayloadSize = 4096
	maxProgressMessageLength   = 256
	maxServerConfigContentSize = 64 * 1024
	maxLogicalFileKeyLength    = 160
)

type ValidationError struct {
	Violations []string
}

func (err ValidationError) Error() string {
	return "validation failed: " + strings.Join(err.Violations, "; ")
}

func (err ValidationError) IsEmpty() bool {
	return len(err.Violations) == 0
}

func appendRequired(violations []string, field string, value string) []string {
	if strings.TrimSpace(value) == "" {
		return append(violations, field+" is required")
	}
	return violations
}

func finish(violations []string) error {
	if len(violations) == 0 {
		return nil
	}
	return ValidationError{Violations: violations}
}

func ValidateUser(user domain.User) error {
	var violations []string
	violations = appendRequired(violations, "id", user.ID)
	violations = appendRequired(violations, "displayName", user.DisplayName)
	if !validUserStatus(user.Status) {
		violations = append(violations, "status is invalid")
	}
	if strings.TrimSpace(user.Email) != "" && !strings.Contains(user.Email, "@") {
		violations = append(violations, "email is invalid")
	}
	if len(user.Profile.ContactNote) > maxContactNoteLength {
		violations = append(violations, "profile.contactNote is too long")
	}
	for i, role := range user.Roles {
		if strings.TrimSpace(role) == "" {
			violations = append(violations, fmt.Sprintf("roles[%d] is required", i))
		}
		if !validUserRole(role) {
			violations = append(violations, fmt.Sprintf("roles[%d] is invalid", i))
		}
	}
	return finish(violations)
}

func ValidateAIProvider(provider domain.AIProvider) error {
	var violations []string
	violations = appendRequired(violations, "id", provider.ID)
	violations = appendRequired(violations, "name", provider.Name)
	violations = appendRequired(violations, "baseUrl", provider.BaseURL)
	if !validAIProviderKind(provider.Kind) {
		violations = append(violations, "kind is invalid")
	}
	if !validAIRelayMode(provider.RelayMode) {
		violations = append(violations, "relayMode is invalid")
	}
	if !validAIProviderStatus(provider.Status) {
		violations = append(violations, "status is invalid")
	}
	if provider.RelayMode == domain.AIRelayModeDirect || provider.RelayMode == domain.AIRelayModeRelay {
		violations = appendRequired(violations, "apiKeyRef", provider.APIKeyRef)
	}
	if looksLikeRawSecret(provider.APIKeyRef) {
		violations = append(violations, "apiKeyRef must reference secret storage, not raw key material")
	}
	violations = appendRequired(violations, "redactionPolicy", provider.RedactionPolicy)
	if provider.TimeoutMS <= 0 {
		violations = append(violations, "timeoutMs must be positive")
	}
	if len(provider.Models) == 0 {
		violations = append(violations, "models must not be empty")
	}
	modelSet := map[string]struct{}{}
	for i, model := range provider.Models {
		model = strings.TrimSpace(model)
		if model == "" {
			violations = append(violations, fmt.Sprintf("models[%d] is required", i))
			continue
		}
		if _, exists := modelSet[model]; exists {
			violations = append(violations, fmt.Sprintf("models[%d] duplicates %q", i, model))
		}
		modelSet[model] = struct{}{}
	}
	if provider.DefaultModel != "" {
		if _, exists := modelSet[provider.DefaultModel]; !exists {
			violations = append(violations, "defaultModel must be included in models")
		}
	}
	return finish(violations)
}

func ValidateGamePlugin(plugin domain.GamePlugin) error {
	var violations []string
	violations = appendRequired(violations, "id", plugin.ID)
	violations = appendRequired(violations, "name", plugin.Name)
	if len(plugin.Description) > maxPluginDescriptionLength {
		violations = append(violations, "description is too long")
	}
	violations = appendRequired(violations, "version", plugin.Version)
	violations = appendRequired(violations, "serverType", plugin.ServerType)
	violations = appendRequired(violations, "manifestRef", plugin.ManifestRef)
	violations = appendRequired(violations, "createFormSchemaRef", plugin.CreateFormSchemaRef)
	if !validGamePluginStatus(plugin.Status) {
		violations = append(violations, "status is invalid")
	}
	for i, capability := range plugin.RequiredRunCapabilities {
		if strings.TrimSpace(capability) == "" {
			violations = append(violations, fmt.Sprintf("requiredRunCapabilities[%d] is required", i))
		} else if !validPluginRunCapability(capability) {
			violations = append(violations, fmt.Sprintf("requiredRunCapabilities[%d] is not allowed", i))
		}
	}
	violations = append(violations, duplicateViolations("requiredRunCapabilities", plugin.RequiredRunCapabilities)...)
	violations = append(violations, validateDeclaredPluginPermissions(plugin.DeclaredPermissions)...)
	violations = append(violations, validateBridgeActions("bridgeActions", plugin.BridgeActions)...)
	violations = append(violations, validatePluginPages(plugin.Pages)...)
	violations = append(violations, duplicateViolations("tags", plugin.Tags)...)
	violations = append(violations, validateAIPurposes(plugin.AIPurposes)...)
	violations = append(violations, validateSafePluginStrings("gamePlugin", pluginSafeStrings(plugin))...)
	return finish(violations)
}

func ValidateGamePluginManifestRegistration(registration domain.GamePluginManifestRegistration) error {
	registration = domain.CopyGamePluginManifestRegistration(registration)
	manifest := registration.Manifest
	var violations []string
	violations = appendRequired(violations, "manifestRef", registration.ManifestRef)
	if !safeRef(registration.ManifestRef) {
		violations = append(violations, "manifestRef is unsafe")
	}
	violations = appendRequired(violations, "manifest.id", manifest.ID)
	violations = appendRequired(violations, "manifest.name", manifest.Name)
	if len(manifest.Description) > maxPluginDescriptionLength {
		violations = append(violations, "manifest.description is too long")
	}
	violations = appendRequired(violations, "manifest.version", manifest.Version)
	if manifest.Kind != "game-plugin" {
		violations = append(violations, "manifest.kind must be game-plugin")
	}
	violations = appendRequired(violations, "manifest.server.type", manifest.Server.Type)
	violations = appendRequired(violations, "manifest.server.displayName", manifest.Server.DisplayName)
	violations = appendRequired(violations, "manifest.server.createFormSchema", manifest.Server.CreateFormSchema)
	if !safeRelativeJSONRef(manifest.Server.CreateFormSchema) {
		violations = append(violations, "manifest.server.createFormSchema must be a safe relative JSON reference")
	}
	for i, osName := range manifest.Server.SupportedOS {
		if !validPluginSupportedOS(osName) {
			violations = append(violations, fmt.Sprintf("manifest.server.supportedOs[%d] is not allowed", i))
		}
	}
	violations = append(violations, duplicateViolations("manifest.server.supportedOs", manifest.Server.SupportedOS)...)
	for i, capability := range manifest.Capabilities {
		if !validPluginRunCapability(capability) {
			violations = append(violations, fmt.Sprintf("manifest.capabilities[%d] is not allowed", i))
		}
	}
	if len(manifest.Capabilities) == 0 {
		violations = append(violations, "manifest.capabilities must not be empty")
	}
	violations = append(violations, duplicateViolations("manifest.capabilities", manifest.Capabilities)...)
	if len(manifest.Permissions) == 0 {
		violations = append(violations, "manifest.permissions must not be empty")
	}
	violations = append(violations, validateDeclaredPluginPermissions(manifest.Permissions)...)
	violations = append(violations, validateBridgeActions("manifest.bridge.actions", manifest.Bridge.Actions)...)
	violations = append(violations, validateLifecycleActions(manifest.Actions)...)
	violations = append(violations, validatePluginPages(manifest.Pages)...)
	violations = append(violations, duplicateViolations("manifest.tags", manifest.Tags)...)
	violations = append(violations, validateAIPurposes(manifest.AI.Purposes)...)
	violations = append(violations, validateSafePluginStrings("manifest", manifestSafeStrings(registration))...)
	return finish(violations)
}

func ValidatePluginBridgeAuthorizeRequest(request domain.PluginBridgeAuthorizeRequest) error {
	var violations []string
	violations = appendRequired(violations, "pluginId", request.PluginID)
	violations = appendRequired(violations, "routeKey", request.RouteKey)
	violations = appendRequired(violations, "action", string(request.Action))
	if !validPluginBridgeAction(request.Action) {
		violations = append(violations, "action is not supported")
	}
	if request.Action == domain.PluginBridgeActionAIInvoke {
		violations = appendRequired(violations, "aiPurpose", request.AIPurpose)
		if strings.TrimSpace(request.AIPurpose) != "" && !validAIPurpose(request.AIPurpose) {
			violations = append(violations, "aiPurpose is not allowed")
		}
	}
	return finish(violations)
}

func ValidatePluginBridgeExecuteRequest(request domain.PluginBridgeExecuteRequest) error {
	request = domain.CopyPluginBridgeExecuteRequest(request)
	var violations []string
	violations = appendRequired(violations, "requestId", request.RequestID)
	violations = appendRequired(violations, "pluginId", request.PluginID)
	violations = appendRequired(violations, "routeKey", request.RouteKey)
	violations = appendRequired(violations, "action", string(request.Action))
	if !validPluginBridgeAction(request.Action) {
		violations = append(violations, "action is not supported")
	}
	if request.Action != domain.PluginBridgeActionAIInvoke {
		violations = appendRequired(violations, "serverInstanceId", request.ServerInstanceID)
	}
	if request.Action == domain.PluginBridgeActionAIInvoke {
		violations = appendRequired(violations, "aiPurpose", request.AIPurpose)
		if strings.TrimSpace(request.AIPurpose) != "" && !validAIPurpose(request.AIPurpose) {
			violations = append(violations, "aiPurpose is not allowed")
		}
	}
	if len(request.Payload) > maxPluginBridgePayloadKeys {
		violations = append(violations, "payload has too many keys")
	}
	payloadSize := 0
	for key, value := range request.Payload {
		payloadSize += len(key) + len(value)
		if strings.TrimSpace(key) == "" || strings.TrimSpace(key) != key || len([]rune(key)) > 80 {
			violations = append(violations, "payload key is invalid")
		}
		if len([]rune(value)) > 1024 {
			violations = append(violations, "payload value is too long")
		}
		for _, reason := range unsafePluginStringReasons(key) {
			violations = append(violations, "payload key: "+reason)
		}
		for _, reason := range unsafePluginStringReasons(value) {
			violations = append(violations, "payload."+key+": "+reason)
		}
		if containsUnsafeRuntimeSecret(value) || strings.Contains(strings.ToLower(value), "unix://") || strings.Contains(strings.ToLower(value), "tcp://") {
			violations = append(violations, "payload contains unsafe content")
		}
	}
	if payloadSize > maxPluginBridgePayloadSize {
		violations = append(violations, "payload is too large")
	}
	return finish(violations)
}

func ValidatePluginMarketplaceFilter(filter domain.PluginMarketplaceFilter) error {
	var violations []string
	if filter.Status != "" && !validGamePluginStatus(filter.Status) {
		violations = append(violations, "status is invalid")
	}
	if strings.TrimSpace(filter.ServerType) != filter.ServerType {
		violations = append(violations, "serverType must not have surrounding whitespace")
	}
	if strings.TrimSpace(filter.Capability) != filter.Capability {
		violations = append(violations, "capability must not have surrounding whitespace")
	}
	if len([]rune(filter.Keyword)) > maxMarketplaceKeywordSize {
		violations = append(violations, "keyword is too long")
	}
	for _, value := range []fieldString{
		{field: "serverType", value: filter.ServerType},
		{field: "capability", value: filter.Capability},
		{field: "keyword", value: filter.Keyword},
	} {
		for _, reason := range unsafePluginStringReasons(value.value) {
			violations = append(violations, "filter."+value.field+": "+reason)
		}
	}
	return finish(violations)
}

func ValidatePluginMarketplaceStateAction(action domain.PluginMarketplaceStateAction) error {
	if validPluginMarketplaceStateAction(action) {
		return nil
	}
	return ValidationError{Violations: []string{"action is not supported"}}
}

func ValidatePluginMarketplacePlugins(plugins []domain.PluginMarketplacePlugin) error {
	var violations []string
	if len(plugins) > maxMarketplaceListSize {
		violations = append(violations, "items is too long")
	}
	for i, plugin := range plugins {
		prefix := fmt.Sprintf("items[%d]", i)
		violations = append(violations, validatePluginMarketplacePlugin(prefix, plugin)...)
	}
	return finish(violations)
}

func ValidatePluginMarketplacePlugin(plugin domain.PluginMarketplacePlugin) error {
	return finish(validatePluginMarketplacePlugin("plugin", plugin))
}

func validatePluginMarketplacePlugin(prefix string, plugin domain.PluginMarketplacePlugin) []string {
	var violations []string
	violations = appendRequired(violations, prefix+".id", plugin.ID)
	violations = appendRequired(violations, prefix+".name", plugin.Name)
	violations = appendRequired(violations, prefix+".version", plugin.Version)
	violations = appendRequired(violations, prefix+".serverType", plugin.ServerType)
	violations = appendRequired(violations, prefix+".manifestRef", plugin.ManifestRef)
	violations = appendRequired(violations, prefix+".createFormSchemaRef", plugin.CreateFormSchemaRef)
	violations = appendRequired(violations, prefix+".source", plugin.Source)
	if !validGamePluginStatus(plugin.Status) {
		violations = append(violations, prefix+".status is invalid")
	}
	if len(plugin.Description) > maxPluginDescriptionLength {
		violations = append(violations, prefix+".description is too long")
	}
	if len(plugin.Capabilities) == 0 {
		violations = append(violations, prefix+".capabilities must not be empty")
	}
	for i, capability := range plugin.Capabilities {
		if !validPluginRunCapability(capability) {
			violations = append(violations, fmt.Sprintf("%s.capabilities[%d] is not allowed", prefix, i))
		}
	}
	for i, osName := range plugin.SupportedOS {
		if !validPluginSupportedOS(osName) {
			violations = append(violations, fmt.Sprintf("%s.supportedOs[%d] is not allowed", prefix, i))
		}
	}
	violations = append(violations, duplicateViolations(prefix+".supportedOs", plugin.SupportedOS)...)
	violations = append(violations, duplicateViolations(prefix+".capabilities", plugin.Capabilities)...)
	violations = append(violations, validateDeclaredPluginPermissions(plugin.DeclaredPermissions)...)
	violations = append(violations, validateBridgeActions(prefix+".bridgeActions", plugin.BridgeActions)...)
	violations = append(violations, validatePluginPages(plugin.Pages)...)
	violations = append(violations, duplicateViolations(prefix+".tags", plugin.Tags)...)
	violations = append(violations, validateAIPurposes(plugin.AIPurposes)...)
	violations = append(violations, validateSafePluginStrings(prefix, marketplacePluginSafeStrings(plugin))...)
	return violations
}

func AuthorizePluginBridgeAction(plugin domain.GamePlugin, request domain.PluginBridgeAuthorizeRequest) (domain.PluginBridgeAuthorization, error) {
	result := domain.PluginBridgeAuthorization{
		PluginID:             request.PluginID,
		RouteKey:             request.RouteKey,
		ServerInstanceID:     request.ServerInstanceID,
		Action:               request.Action,
		RequiredPermissions:  requiredBridgePermissions(request.Action),
		EffectivePermissions: effectivePagePermissions(plugin, request.RouteKey),
	}
	if err := ValidateGamePlugin(plugin); err != nil {
		return result, err
	}
	if err := ValidatePluginBridgeAuthorizeRequest(request); err != nil {
		return result, err
	}
	if plugin.ID != request.PluginID {
		result.Reason = "pluginId must match installed plugin"
		return result, nil
	}
	if plugin.Status != domain.GamePluginStatusInstalled {
		result.Reason = "plugin must be installed"
		return result, nil
	}
	if !containsString(plugin.BridgeActions, string(request.Action)) {
		result.Reason = "bridge action is not declared by plugin"
		return result, nil
	}
	page, pageFound := findPluginPage(plugin.Pages, request.RouteKey)
	if !pageFound {
		result.Reason = "routeKey is not declared by plugin"
		return result, nil
	}
	if len(page.BridgeActions) > 0 && !containsString(page.BridgeActions, string(request.Action)) {
		result.Reason = "bridge action is not declared by page"
		return result, nil
	}
	if !containsAll(result.EffectivePermissions, result.RequiredPermissions) {
		result.Reason = "required permission is missing"
		return result, nil
	}
	if request.Action == domain.PluginBridgeActionAIInvoke && !containsString(plugin.AIPurposes, request.AIPurpose) {
		result.Reason = "ai purpose is not declared by plugin"
		return result, nil
	}
	result.Allowed = true
	return result, nil
}

func ValidateServerInstance(instance domain.ServerInstance) error {
	var violations []string
	violations = appendRequired(violations, "id", instance.ID)
	violations = appendRequired(violations, "pluginId", instance.PluginID)
	violations = appendRequired(violations, "pluginVersion", instance.PluginVersion)
	violations = appendRequired(violations, "runEndpointId", instance.RunEndpointID)
	violations = appendRequired(violations, "name", instance.Name)
	if strings.TrimSpace(instance.OwnerUserID) != instance.OwnerUserID {
		violations = append(violations, "ownerUserId must not have surrounding whitespace")
	}
	for i, userID := range instance.AdminUserIDs {
		if strings.TrimSpace(userID) == "" {
			violations = append(violations, fmt.Sprintf("adminUserIds[%d] is required", i))
		}
		if strings.TrimSpace(userID) != userID {
			violations = append(violations, fmt.Sprintf("adminUserIds[%d] must not have surrounding whitespace", i))
		}
		if userID == instance.OwnerUserID {
			violations = append(violations, fmt.Sprintf("adminUserIds[%d] must not duplicate ownerUserId", i))
		}
	}
	violations = append(violations, duplicateViolations("adminUserIds", instance.AdminUserIDs)...)
	if !validServerInstanceState(instance.State) {
		violations = append(violations, "state is invalid")
	}
	if instance.State == domain.ServerInstanceStateDeleted {
		violations = append(violations, "state must not be deleted on create")
	}
	if instance.ConfigVersion < 0 {
		violations = append(violations, "configVersion must not be negative")
	}
	return finish(violations)
}

func ValidateServerInstanceDependencies(instance domain.ServerInstance, plugin domain.GamePlugin, endpoint domain.RunEndpoint) error {
	var violations []string
	if plugin.ID == "" {
		violations = append(violations, "plugin is required")
	} else {
		if plugin.ID != instance.PluginID {
			violations = append(violations, "pluginId must match plugin")
		}
		if plugin.Status != domain.GamePluginStatusInstalled {
			violations = append(violations, "plugin must be installed")
		}
		if plugin.Version != instance.PluginVersion {
			violations = append(violations, "pluginVersion must match plugin")
		}
	}
	if endpoint.ID == "" {
		violations = append(violations, "run endpoint is required")
	} else {
		if endpoint.ID != instance.RunEndpointID {
			violations = append(violations, "runEndpointId must match run endpoint")
		}
		if endpoint.Status != domain.RunEndpointStatusOnline && endpoint.Status != domain.RunEndpointStatusDegraded {
			violations = append(violations, "run endpoint must be online or degraded")
		}
		missing := MissingCapabilities(endpoint.Capabilities, plugin.RequiredRunCapabilities)
		if len(missing) > 0 {
			violations = append(violations, "run endpoint missing required capabilities: "+strings.Join(missing, ", "))
		}
	}
	return finish(violations)
}

func ValidatePlatformResourceUsage(usage domain.PlatformResourceUsage) error {
	var violations []string
	violations = appendPercentViolation(violations, "cpuPercent", usage.CPUPercent)
	violations = appendPercentViolation(violations, "memoryPercent", usage.MemoryPercent)
	violations = appendPercentViolation(violations, "diskPercent", usage.DiskPercent)
	violations = appendRequired(violations, "source", usage.Source)
	if usage.CollectedAt.IsZero() {
		violations = append(violations, "collectedAt is required")
	}
	return finish(violations)
}

func ValidateServerMetricsList(items []domain.ServerMetrics) error {
	var violations []string
	if len(items) > 1000 {
		violations = append(violations, "items is too long")
	}
	for i, item := range items {
		field := fmt.Sprintf("items[%d]", i)
		if strings.TrimSpace(item.ServerInstanceID) == "" {
			violations = append(violations, field+".serverInstanceId is required")
		}
		if item.CollectedAt.IsZero() {
			violations = append(violations, field+".collectedAt is required")
		}
		if strings.TrimSpace(item.Source) == "" {
			violations = append(violations, field+".source is required")
		}
		violations = appendOptionalPercentViolation(violations, field+".cpuPercent", item.CPUPercent)
		violations = appendOptionalPercentViolation(violations, field+".memoryPercent", item.MemoryPercent)
		violations = appendOptionalPercentViolation(violations, field+".diskPercent", item.DiskPercent)
		if item.PlayerCount != nil && *item.PlayerCount < 0 {
			violations = append(violations, field+".playerCount must not be negative")
		}
		if item.MaxPlayers != nil && *item.MaxPlayers < 0 {
			violations = append(violations, field+".maxPlayers must not be negative")
		}
		if item.TPS != nil && (*item.TPS < 0 || *item.TPS > 100) {
			violations = append(violations, field+".tps must be between 0 and 100")
		}
		if item.LatencyMS != nil && *item.LatencyMS < 0 {
			violations = append(violations, field+".latencyMs must not be negative")
		}
	}
	return finish(violations)
}

func ValidateServerConfig(config domain.ServerConfig) error {
	var violations []string
	violations = appendRequired(violations, "serverInstanceId", config.ServerInstanceID)
	violations = appendRequired(violations, "format", config.Format)
	violations = appendRequired(violations, "key", config.Key)
	if config.ConfigVersion <= 0 {
		violations = append(violations, "configVersion must be positive")
	}
	if len([]byte(config.Content)) > maxServerConfigContentSize {
		violations = append(violations, "content is too large")
	}
	if config.UpdatedAt.IsZero() {
		violations = append(violations, "updatedAt is required")
	}
	if containsUnsafeRuntimeSecret(config.Content) {
		violations = append(violations, "content must not expose raw secrets, host paths, or direct sockets")
	}
	return finish(violations)
}

func ValidateServerConfigDiffRequest(request domain.ServerConfigDiffRequest) error {
	var violations []string
	violations = appendRequired(violations, "serverInstanceId", request.ServerInstanceID)
	violations = appendRequired(violations, "key", request.Key)
	if request.ExpectedConfigVersion <= 0 {
		violations = append(violations, "expectedConfigVersion must be positive")
	}
	if !validLogicalFileKey(request.Key) || !validConfigFileKey(request.Key) {
		violations = append(violations, "key is not allowed")
	}
	if len([]byte(request.ProposedContent)) > maxServerConfigContentSize {
		violations = append(violations, "proposedContent is too large")
	}
	if containsUnsafeRuntimeSecret(request.ProposedContent) {
		violations = append(violations, "proposedContent must not expose raw secrets, host paths, or direct sockets")
	}
	if request.ProposedContentInputRef != "" && !validScopedInputRef(request.ProposedContentInputRef) {
		violations = append(violations, "proposedContentInputRef is not allowed")
	}
	return finish(violations)
}

func ValidateServerConfigWriteApproval(approval domain.ServerConfigWriteApproval) error {
	request := domain.ServerConfigDiffRequest{
		ServerInstanceID:        approval.ServerInstanceID,
		ExpectedConfigVersion:   approval.ExpectedConfigVersion,
		Key:                     approval.Key,
		ProposedContent:         approval.ProposedContent,
		ProposedContentInputRef: approval.ProposedContentInputRef,
	}
	var violations []string
	if err := ValidateServerConfigDiffRequest(request); err != nil {
		if validationErr, ok := err.(ValidationError); ok {
			violations = append(violations, validationErr.Violations...)
		} else {
			violations = append(violations, err.Error())
		}
	}
	violations = appendRequired(violations, "idempotencyKey", approval.IdempotencyKey)
	if containsUnsafeRuntimeSecret(approval.IdempotencyKey) || looksLikeRawHostPath(approval.IdempotencyKey) {
		violations = append(violations, "idempotencyKey is not allowed")
	}
	return finish(violations)
}

func ValidateFileOperationDispatchRequest(request domain.FileOperationDispatchRequest) error {
	var violations []string
	violations = appendRequired(violations, "serverInstanceId", request.ServerInstanceID)
	violations = appendRequired(violations, "key", request.Key)
	violations = appendRequired(violations, "idempotencyKey", request.IdempotencyKey)
	if !validFileOperationKind(request.Operation) {
		violations = append(violations, "operation is invalid")
	}
	if !validLogicalFileKey(request.Key) {
		violations = append(violations, "key is not allowed")
	}
	if request.Operation == domain.FileOperationWrite && request.InputRef == "" {
		violations = append(violations, "inputRef is required for writes")
	}
	if request.InputRef != "" && !validScopedInputRef(request.InputRef) {
		violations = append(violations, "inputRef is not allowed")
	}
	if request.ExpectedConfigVersion < 0 {
		violations = append(violations, "expectedConfigVersion must not be negative")
	}
	for _, value := range []string{request.PluginID, request.IdempotencyKey} {
		if containsUnsafeRuntimeSecret(value) || looksLikeRawHostPath(value) || strings.Contains(strings.ToLower(value), "unix://") {
			violations = append(violations, "request contains unsafe content")
		}
	}
	return finish(violations)
}

func appendPercentViolation(violations []string, field string, value float64) []string {
	if value < 0 || value > 100 {
		return append(violations, field+" must be between 0 and 100")
	}
	return violations
}

func appendOptionalPercentViolation(violations []string, field string, value *float64) []string {
	if value == nil {
		return violations
	}
	return appendPercentViolation(violations, field, *value)
}

func containsUnsafeRuntimeSecret(value string) bool {
	lower := strings.ToLower(value)
	unsafeFragments := []string{
		"/users/",
		"/var/run/",
		"unix://",
		"tcp://",
		"bearer ",
		"api_key=",
		"apikey=",
		"password=",
		"secret=",
		"sk-",
	}
	for _, fragment := range unsafeFragments {
		if strings.Contains(lower, fragment) {
			return true
		}
	}
	return false
}

func ValidateRunEndpoint(endpoint domain.RunEndpoint) error {
	var violations []string
	violations = appendRequired(violations, "id", endpoint.ID)
	violations = appendRequired(violations, "displayName", endpoint.DisplayName)
	violations = appendRequired(violations, "version", endpoint.Version)
	if !validRunEndpointStatus(endpoint.Status) {
		violations = append(violations, "status is invalid")
	}
	if endpoint.Capacity.MaxJobs < 0 || endpoint.Capacity.RunningJobs < 0 || endpoint.Capacity.QueuedJobs < 0 {
		violations = append(violations, "capacity counts must not be negative")
	}
	if endpoint.Capacity.MaxJobs > 0 && endpoint.Capacity.RunningJobs > endpoint.Capacity.MaxJobs {
		violations = append(violations, "runningJobs must not exceed maxJobs")
	}
	for i, capability := range endpoint.Capabilities {
		if strings.TrimSpace(capability) == "" {
			violations = append(violations, fmt.Sprintf("capabilities[%d] is required", i))
		}
	}
	return finish(violations)
}

func ValidateJob(job domain.Job) error {
	var violations []string
	violations = appendRequired(violations, "id", job.ID)
	violations = appendRequired(violations, "runEndpointId", job.RunEndpointID)
	violations = appendRequired(violations, "capability", job.Capability)
	violations = appendRequired(violations, "idempotencyKey", job.IdempotencyKey)
	if !validJobState(job.State) {
		violations = append(violations, "state is invalid")
	}
	if job.Progress.Percent < 0 || job.Progress.Percent > 100 {
		violations = append(violations, "progress.percent must be between 0 and 100")
	}
	if len(job.Progress.Message) > maxProgressMessageLength {
		violations = append(violations, "progress.message is too long")
	}
	if job.TargetKey != "" && !validLogicalFileKey(job.TargetKey) {
		violations = append(violations, "targetKey is not allowed")
	}
	if job.InputRef != "" && !validScopedInputRef(job.InputRef) {
		violations = append(violations, "inputRef is not allowed")
	}
	if job.Capability == domain.JobCapabilityConfigWrite || job.Capability == domain.JobCapabilityFilesRead || job.Capability == domain.JobCapabilityFilesWrite {
		if job.ServerInstanceID == "" {
			violations = append(violations, "serverInstanceId is required for scoped file jobs")
		}
		if job.TargetKey == "" {
			violations = append(violations, "targetKey is required for scoped file jobs")
		}
	}
	if job.Capability == domain.JobCapabilityConfigWrite || job.Capability == domain.JobCapabilityFilesWrite {
		if job.InputRef == "" {
			violations = append(violations, "inputRef is required for scoped write jobs")
		}
	}
	return finish(violations)
}

func ValidateArtifact(artifact domain.Artifact) error {
	var violations []string
	violations = appendRequired(violations, "id", artifact.ID)
	violations = appendRequired(violations, "ownerId", artifact.OwnerID)
	violations = appendRequired(violations, "checksum", artifact.Checksum)
	if !validArtifactOwnerKind(artifact.OwnerKind) {
		violations = append(violations, "ownerKind is invalid")
	}
	if !validArtifactState(artifact.State) {
		violations = append(violations, "state is invalid")
	}
	if artifact.SizeBytes < 0 {
		violations = append(violations, "sizeBytes must not be negative")
	}
	return finish(violations)
}

func ValidateLogStream(stream domain.LogStream) error {
	var violations []string
	violations = appendRequired(violations, "id", stream.ID)
	violations = appendRequired(violations, "serverInstanceId", stream.ServerInstanceID)
	violations = appendRequired(violations, "streamKey", stream.StreamKey)
	violations = appendRequired(violations, "retentionPolicy", stream.RetentionPolicy)
	if !validLogStreamSource(stream.Source) {
		violations = append(violations, "source is invalid")
	}
	if !validLogStorageBackend(stream.StorageBackend) {
		violations = append(violations, "storageBackend is invalid")
	}
	return finish(violations)
}

func ValidateAuditEvent(event domain.AuditEvent) error {
	var violations []string
	violations = appendRequired(violations, "id", event.ID)
	violations = appendRequired(violations, "actorId", event.ActorID)
	violations = appendRequired(violations, "action", event.Action)
	violations = appendRequired(violations, "resourceKind", event.ResourceKind)
	violations = appendRequired(violations, "resourceId", event.ResourceID)
	violations = appendRequired(violations, "summary", event.Summary)
	if !validAuditResult(event.Result) {
		violations = append(violations, "result is invalid")
	}
	if len(event.Summary) > maxAuditSummaryLength {
		violations = append(violations, "summary is too long")
	}
	if looksLikeRawSecret(event.Summary) {
		violations = append(violations, "summary must be redacted")
	}
	return finish(violations)
}

func MissingCapabilities(actual []string, required []string) []string {
	actualSet := make(map[string]struct{}, len(actual))
	for _, capability := range actual {
		actualSet[capability] = struct{}{}
	}
	var missing []string
	for _, capability := range required {
		if _, exists := actualSet[capability]; !exists {
			missing = append(missing, capability)
		}
	}
	return missing
}

type fieldString struct {
	field string
	value string
}

func duplicateViolations(field string, values []string) []string {
	seen := map[string]struct{}{}
	var violations []string
	for i, value := range values {
		trimmed := strings.TrimSpace(value)
		if trimmed == "" {
			violations = append(violations, fmt.Sprintf("%s[%d] is required", field, i))
			continue
		}
		if _, exists := seen[trimmed]; exists {
			violations = append(violations, fmt.Sprintf("%s[%d] duplicates an earlier value", field, i))
		}
		seen[trimmed] = struct{}{}
	}
	return violations
}

func validateDeclaredPluginPermissions(permissions []string) []string {
	var violations []string
	for i, permission := range permissions {
		if !validPluginPermission(permission) {
			violations = append(violations, fmt.Sprintf("permissions[%d] is not allowed", i))
		}
	}
	violations = append(violations, duplicateViolations("permissions", permissions)...)
	return violations
}

func validateLifecycleActions(actions domain.PluginLifecycleActions) []string {
	var violations []string
	required := []fieldString{
		{field: "actions.install", value: actions.Install},
		{field: "actions.start", value: actions.Start},
		{field: "actions.stop", value: actions.Stop},
	}
	for _, action := range required {
		violations = appendRequired(violations, action.field, action.value)
	}
	for _, action := range []fieldString{
		{field: "actions.install", value: actions.Install},
		{field: "actions.start", value: actions.Start},
		{field: "actions.stop", value: actions.Stop},
		{field: "actions.restart", value: actions.Restart},
		{field: "actions.status", value: actions.Status},
	} {
		if strings.TrimSpace(action.value) != "" && !safeRelativeJSONRef(action.value) {
			violations = append(violations, action.field+" must be a safe relative JSON reference")
		}
	}
	return violations
}

func validatePluginPages(pages []domain.GamePluginPage) []string {
	var violations []string
	seenKeys := map[string]struct{}{}
	for i, page := range pages {
		prefix := fmt.Sprintf("pages[%d]", i)
		violations = appendRequired(violations, prefix+".key", page.Key)
		violations = appendRequired(violations, prefix+".title", page.Title)
		violations = appendRequired(violations, prefix+".path", page.Path)
		if len(page.Title) > maxPluginPageTitleLength {
			violations = append(violations, prefix+".title is too long")
		}
		if !validPluginPagePath(page.Path) {
			violations = append(violations, prefix+".path is invalid")
		}
		if page.Key != "" {
			if _, exists := seenKeys[page.Key]; exists {
				violations = append(violations, prefix+".key duplicates another page")
			}
			seenKeys[page.Key] = struct{}{}
		}
		for permissionIndex, permission := range page.Permissions {
			if !validPluginPermission(permission) {
				violations = append(violations, fmt.Sprintf("%s.permissions[%d] is not allowed", prefix, permissionIndex))
			}
		}
		violations = append(violations, duplicateViolations(prefix+".permissions", page.Permissions)...)
		violations = append(violations, validateBridgeActions(prefix+".bridgeActions", page.BridgeActions)...)
	}
	return violations
}

func validateBridgeActions(field string, actions []string) []string {
	var violations []string
	for i, action := range actions {
		if !validPluginBridgeAction(domain.PluginBridgeAction(action)) {
			violations = append(violations, fmt.Sprintf("%s[%d] is not supported", field, i))
		}
	}
	violations = append(violations, duplicateViolations(field, actions)...)
	return violations
}

func validateAIPurposes(purposes []string) []string {
	var violations []string
	for i, purpose := range purposes {
		if !validAIPurpose(purpose) {
			violations = append(violations, fmt.Sprintf("aiPurposes[%d] is not allowed", i))
		}
	}
	violations = append(violations, duplicateViolations("aiPurposes", purposes)...)
	return violations
}

func validateSafePluginStrings(prefix string, values []fieldString) []string {
	var violations []string
	for _, value := range values {
		for _, reason := range unsafePluginStringReasons(value.value) {
			violations = append(violations, prefix+"."+value.field+": "+reason)
		}
	}
	return violations
}

func pluginSafeStrings(plugin domain.GamePlugin) []fieldString {
	values := []fieldString{
		{field: "id", value: plugin.ID},
		{field: "name", value: plugin.Name},
		{field: "description", value: plugin.Description},
		{field: "serverType", value: plugin.ServerType},
		{field: "serverDisplayName", value: plugin.ServerDisplayName},
		{field: "manifestRef", value: plugin.ManifestRef},
		{field: "createFormSchemaRef", value: plugin.CreateFormSchemaRef},
		{field: "actions.install", value: plugin.LifecycleActions.Install},
		{field: "actions.start", value: plugin.LifecycleActions.Start},
		{field: "actions.stop", value: plugin.LifecycleActions.Stop},
		{field: "actions.restart", value: plugin.LifecycleActions.Restart},
		{field: "actions.status", value: plugin.LifecycleActions.Status},
	}
	values = appendStringSliceFields(values, "supportedOs", plugin.SupportedOS)
	values = appendStringSliceFields(values, "requiredRunCapabilities", plugin.RequiredRunCapabilities)
	values = appendStringSliceFields(values, "declaredPermissions", plugin.DeclaredPermissions)
	values = appendStringSliceFields(values, "tags", plugin.Tags)
	values = appendStringSliceFields(values, "aiPurposes", plugin.AIPurposes)
	values = appendStringSliceFields(values, "bridgeActions", plugin.BridgeActions)
	for i, page := range plugin.Pages {
		prefix := fmt.Sprintf("pages[%d]", i)
		values = append(values,
			fieldString{field: prefix + ".key", value: page.Key},
			fieldString{field: prefix + ".title", value: page.Title},
			fieldString{field: prefix + ".path", value: page.Path},
		)
		values = appendStringSliceFields(values, prefix+".permissions", page.Permissions)
		values = appendStringSliceFields(values, prefix+".bridgeActions", page.BridgeActions)
	}
	return values
}

func manifestSafeStrings(registration domain.GamePluginManifestRegistration) []fieldString {
	manifest := registration.Manifest
	values := []fieldString{
		{field: "manifestRef", value: registration.ManifestRef},
		{field: "id", value: manifest.ID},
		{field: "name", value: manifest.Name},
		{field: "description", value: manifest.Description},
		{field: "kind", value: manifest.Kind},
		{field: "server.type", value: manifest.Server.Type},
		{field: "server.displayName", value: manifest.Server.DisplayName},
		{field: "server.createFormSchema", value: manifest.Server.CreateFormSchema},
		{field: "actions.install", value: manifest.Actions.Install},
		{field: "actions.start", value: manifest.Actions.Start},
		{field: "actions.stop", value: manifest.Actions.Stop},
		{field: "actions.restart", value: manifest.Actions.Restart},
		{field: "actions.status", value: manifest.Actions.Status},
	}
	values = appendStringSliceFields(values, "tags", manifest.Tags)
	values = appendStringSliceFields(values, "server.supportedOs", manifest.Server.SupportedOS)
	values = appendStringSliceFields(values, "bridge.actions", manifest.Bridge.Actions)
	values = appendStringSliceFields(values, "capabilities", manifest.Capabilities)
	values = appendStringSliceFields(values, "permissions", manifest.Permissions)
	values = appendStringSliceFields(values, "ai.purposes", manifest.AI.Purposes)
	for i, page := range manifest.Pages {
		prefix := fmt.Sprintf("pages[%d]", i)
		values = append(values,
			fieldString{field: prefix + ".key", value: page.Key},
			fieldString{field: prefix + ".title", value: page.Title},
			fieldString{field: prefix + ".path", value: page.Path},
		)
		values = appendStringSliceFields(values, prefix+".permissions", page.Permissions)
		values = appendStringSliceFields(values, prefix+".bridgeActions", page.BridgeActions)
	}
	return values
}

func marketplacePluginSafeStrings(plugin domain.PluginMarketplacePlugin) []fieldString {
	values := []fieldString{
		{field: "id", value: plugin.ID},
		{field: "name", value: plugin.Name},
		{field: "description", value: plugin.Description},
		{field: "serverType", value: plugin.ServerType},
		{field: "serverDisplayName", value: plugin.ServerDisplayName},
		{field: "manifestRef", value: plugin.ManifestRef},
		{field: "createFormSchemaRef", value: plugin.CreateFormSchemaRef},
		{field: "actions.install", value: plugin.LifecycleActions.Install},
		{field: "actions.start", value: plugin.LifecycleActions.Start},
		{field: "actions.stop", value: plugin.LifecycleActions.Stop},
		{field: "actions.restart", value: plugin.LifecycleActions.Restart},
		{field: "actions.status", value: plugin.LifecycleActions.Status},
		{field: "source", value: plugin.Source},
	}
	values = appendStringSliceFields(values, "supportedOs", plugin.SupportedOS)
	values = appendStringSliceFields(values, "capabilities", plugin.Capabilities)
	values = appendStringSliceFields(values, "declaredPermissions", plugin.DeclaredPermissions)
	values = appendStringSliceFields(values, "tags", plugin.Tags)
	values = appendStringSliceFields(values, "aiPurposes", plugin.AIPurposes)
	values = appendStringSliceFields(values, "bridgeActions", plugin.BridgeActions)
	for i, page := range plugin.Pages {
		prefix := fmt.Sprintf("pages[%d]", i)
		values = append(values,
			fieldString{field: prefix + ".key", value: page.Key},
			fieldString{field: prefix + ".title", value: page.Title},
			fieldString{field: prefix + ".path", value: page.Path},
		)
		values = appendStringSliceFields(values, prefix+".permissions", page.Permissions)
		values = appendStringSliceFields(values, prefix+".bridgeActions", page.BridgeActions)
	}
	return values
}

func appendStringSliceFields(values []fieldString, field string, items []string) []fieldString {
	for i, item := range items {
		values = append(values, fieldString{field: fmt.Sprintf("%s[%d]", field, i), value: item})
	}
	return values
}

func unsafePluginStringReasons(value string) []string {
	trimmed := strings.TrimSpace(value)
	lowered := strings.ToLower(trimmed)
	if trimmed == "" {
		return nil
	}
	var reasons []string
	if looksLikeRawSecret(trimmed) || strings.Contains(lowered, "raw api key") || strings.Contains(lowered, "provider key") || strings.Contains(lowered, "ai key") || strings.Contains(lowered, "raw credential") {
		reasons = append(reasons, "raw credential or AI/provider key content is not allowed")
	}
	if strings.Contains(lowered, "direct run") || strings.Contains(lowered, "run socket") || strings.Contains(lowered, "run credential") || strings.Contains(lowered, "run token") || strings.Contains(lowered, "direct socket") {
		reasons = append(reasons, "direct run access request is not allowed")
	}
	if strings.HasPrefix(lowered, "file://") || strings.HasPrefix(trimmed, `\\`) || looksLikeRawHostPath(trimmed) || strings.Contains(lowered, "host path") || strings.Contains(lowered, "raw host path") {
		reasons = append(reasons, "raw host path access is not allowed")
	}
	return reasons
}

func looksLikeRawHostPath(value string) bool {
	if len(value) >= 3 && ((value[1] == ':' && value[2] == '\\') || (value[1] == ':' && value[2] == '/')) {
		return true
	}
	lowered := strings.ToLower(value)
	for _, prefix := range []string{"/users/", "/etc/", "/var/", "/tmp/", "/home/", "/root/", "/private/", "/volumes/", "/opt/"} {
		if strings.HasPrefix(lowered, prefix) {
			return true
		}
	}
	return false
}

func safeRef(value string) bool {
	trimmed := strings.TrimSpace(value)
	return strings.HasPrefix(trimmed, "artifact://") || strings.HasPrefix(trimmed, "manifest://") || safeRelativeJSONRef(trimmed)
}

func safeRelativeJSONRef(value string) bool {
	trimmed := strings.TrimSpace(value)
	lowered := strings.ToLower(trimmed)
	if trimmed == "" || strings.HasPrefix(trimmed, "/") || strings.Contains(trimmed, "..") || strings.Contains(trimmed, "://") || strings.Contains(trimmed, `\`) || !strings.HasSuffix(lowered, ".json") {
		return false
	}
	if len(trimmed) >= 2 && trimmed[1] == ':' {
		return false
	}
	return true
}

func looksLikeRawSecret(value string) bool {
	trimmed := strings.TrimSpace(strings.ToLower(value))
	if trimmed == "" {
		return false
	}
	if strings.HasPrefix(trimmed, "secret://") || strings.HasPrefix(trimmed, "vault://") || strings.HasPrefix(trimmed, "env://") {
		return false
	}
	return strings.HasPrefix(trimmed, "sk-") ||
		strings.HasPrefix(trimmed, "sk_") ||
		strings.Contains(trimmed, "api_key=") ||
		strings.Contains(trimmed, "apikey=") ||
		strings.Contains(trimmed, "bearer ")
}

func validUserStatus(status domain.UserStatus) bool {
	switch status {
	case domain.UserStatusActive, domain.UserStatusDisabled, domain.UserStatusPending:
		return true
	default:
		return false
	}
}

func validUserRole(role string) bool {
	switch strings.ToLower(strings.TrimSpace(role)) {
	case "admin", "platform-admin", "platformadmin", "server-owner", "owner", "server-admin", "operator":
		return true
	default:
		return false
	}
}

func validAIProviderKind(kind domain.AIProviderKind) bool {
	switch kind {
	case domain.AIProviderKindOpenAICompatible, domain.AIProviderKindOpenAI, domain.AIProviderKindClaude, domain.AIProviderKindGemini, domain.AIProviderKindOllama, domain.AIProviderKindCustom:
		return true
	default:
		return false
	}
}

func validAIRelayMode(mode domain.AIRelayMode) bool {
	switch mode {
	case domain.AIRelayModeDirect, domain.AIRelayModeRelay, domain.AIRelayModeLocal:
		return true
	default:
		return false
	}
}

func validAIProviderStatus(status domain.AIProviderStatus) bool {
	switch status {
	case domain.AIProviderStatusActive, domain.AIProviderStatusDisabled, domain.AIProviderStatusError:
		return true
	default:
		return false
	}
}

func validGamePluginStatus(status domain.GamePluginStatus) bool {
	switch status {
	case domain.GamePluginStatusInstalled, domain.GamePluginStatusDisabled, domain.GamePluginStatusInvalid, domain.GamePluginStatusUpdating:
		return true
	default:
		return false
	}
}

func validPluginMarketplaceStateAction(action domain.PluginMarketplaceStateAction) bool {
	switch action {
	case domain.PluginMarketplaceStateActionInstall, domain.PluginMarketplaceStateActionEnable, domain.PluginMarketplaceStateActionDisable:
		return true
	default:
		return false
	}
}

func validPluginRunCapability(capability string) bool {
	switch capability {
	case "process.install", "process.start", "process.stop", "process.restart", "process.status",
		"config.write",
		"files.list", "files.read", "files.write", "files.patch",
		"file.list", "file.read", "file.write", "file.patch",
		"logs.read", "log.query",
		"artifacts.read", "artifacts.write", "artifact.read", "artifact.write",
		"ai.invoke":
		return true
	default:
		return false
	}
}

func validFileOperationKind(operation domain.FileOperationKind) bool {
	switch operation {
	case domain.FileOperationRead, domain.FileOperationWrite:
		return true
	default:
		return false
	}
}

func validConfigFileKey(key string) bool {
	switch key {
	case "server.properties", "config/server.properties":
		return true
	default:
		return strings.HasPrefix(key, "config/") && (strings.HasSuffix(key, ".properties") || strings.HasSuffix(key, ".json"))
	}
}

func validLogicalFileKey(key string) bool {
	trimmed := strings.TrimSpace(key)
	if trimmed == "" || trimmed != key || len([]rune(key)) > maxLogicalFileKeyLength {
		return false
	}
	if strings.HasPrefix(key, "/") || strings.Contains(key, "..") || strings.Contains(key, `\`) || strings.Contains(key, "://") || looksLikeRawHostPath(key) || containsUnsafeRuntimeSecret(key) {
		return false
	}
	for _, char := range key {
		if (char >= 'a' && char <= 'z') || (char >= 'A' && char <= 'Z') || (char >= '0' && char <= '9') || char == '_' || char == '-' || char == '.' || char == '/' {
			continue
		}
		return false
	}
	return true
}

func validScopedInputRef(ref string) bool {
	trimmed := strings.TrimSpace(ref)
	if trimmed == "" || trimmed != ref || containsUnsafeRuntimeSecret(ref) || looksLikeRawHostPath(ref) {
		return false
	}
	return strings.HasPrefix(ref, "input://") || strings.HasPrefix(ref, "artifact://")
}

func validPluginPermission(permission string) bool {
	switch permission {
	case "server.create", "server.read", "server.lifecycle", "server.files.read", "server.files.write", "server.logs.read", "server.artifacts.read", "server.artifacts.write", "ai.invoke":
		return true
	default:
		return false
	}
}

func validPluginBridgeAction(action domain.PluginBridgeAction) bool {
	switch action {
	case domain.PluginBridgeActionServerInstancesRead,
		domain.PluginBridgeActionJobsDispatch,
		domain.PluginBridgeActionLogsQuery,
		domain.PluginBridgeActionArtifactsOpen,
		domain.PluginBridgeActionFilesRequest,
		domain.PluginBridgeActionAIInvoke:
		return true
	default:
		return false
	}
}

func requiredBridgePermissions(action domain.PluginBridgeAction) []string {
	switch action {
	case domain.PluginBridgeActionServerInstancesRead:
		return []string{"server.read"}
	case domain.PluginBridgeActionJobsDispatch:
		return []string{"server.lifecycle"}
	case domain.PluginBridgeActionLogsQuery:
		return []string{"server.logs.read"}
	case domain.PluginBridgeActionArtifactsOpen:
		return []string{"server.artifacts.read"}
	case domain.PluginBridgeActionFilesRequest:
		return []string{"server.files.read"}
	case domain.PluginBridgeActionAIInvoke:
		return []string{"ai.invoke"}
	default:
		return nil
	}
}

func effectivePagePermissions(plugin domain.GamePlugin, routeKey string) []string {
	declared := plugin.DeclaredPermissions
	page, found := findPluginPage(plugin.Pages, routeKey)
	if !found || len(page.Permissions) == 0 {
		return domain.CopyStringSlice(declared)
	}
	var effective []string
	for _, permission := range page.Permissions {
		if containsString(declared, permission) {
			effective = append(effective, permission)
		}
	}
	return effective
}

func findPluginPage(pages []domain.GamePluginPage, routeKey string) (domain.GamePluginPage, bool) {
	for _, page := range pages {
		if page.Key == routeKey {
			return page, true
		}
	}
	return domain.GamePluginPage{}, false
}

func containsAll(values []string, required []string) bool {
	for _, value := range required {
		if !containsString(values, value) {
			return false
		}
	}
	return true
}

func containsString(values []string, target string) bool {
	for _, value := range values {
		if value == target {
			return true
		}
	}
	return false
}

func validPluginSupportedOS(osName string) bool {
	switch osName {
	case "windows", "linux", "darwin":
		return true
	default:
		return false
	}
}

func validPluginPagePath(path string) bool {
	if !strings.HasPrefix(path, "/") || strings.Contains(path, "..") || strings.Contains(path, `\`) || strings.Contains(path, "://") {
		return false
	}
	for _, char := range path[1:] {
		if (char >= 'a' && char <= 'z') || (char >= '0' && char <= '9') || char == '_' || char == '.' || char == '/' || char == '-' {
			continue
		}
		return false
	}
	return true
}

func validAIPurpose(purpose string) bool {
	switch purpose {
	case "config.read", "config.generate", "config.suggest", "logs.diagnose", "files.suggest":
		return true
	default:
		return false
	}
}

func validServerInstanceState(state domain.ServerInstanceState) bool {
	switch state {
	case domain.ServerInstanceStateDraft, domain.ServerInstanceStateInstalling, domain.ServerInstanceStateReady, domain.ServerInstanceStateRunning, domain.ServerInstanceStateStopped, domain.ServerInstanceStateFailed, domain.ServerInstanceStateDeleted:
		return true
	default:
		return false
	}
}

func validRunEndpointStatus(status domain.RunEndpointStatus) bool {
	switch status {
	case domain.RunEndpointStatusOnline, domain.RunEndpointStatusOffline, domain.RunEndpointStatusDegraded, domain.RunEndpointStatusDisabled:
		return true
	default:
		return false
	}
}

func validJobState(state domain.JobState) bool {
	switch state {
	case domain.JobStateQueued, domain.JobStateAccepted, domain.JobStateRunning, domain.JobStateSucceeded, domain.JobStateFailed, domain.JobStateCancelled:
		return true
	default:
		return false
	}
}

func validArtifactOwnerKind(kind domain.ArtifactOwnerKind) bool {
	switch kind {
	case domain.ArtifactOwnerKindPlatform, domain.ArtifactOwnerKindPlugin, domain.ArtifactOwnerKindServerInstance, domain.ArtifactOwnerKindJob:
		return true
	default:
		return false
	}
}

func validArtifactState(state domain.ArtifactState) bool {
	switch state {
	case domain.ArtifactStateUploading, domain.ArtifactStateAvailable, domain.ArtifactStateExpired, domain.ArtifactStateFailed:
		return true
	default:
		return false
	}
}

func validLogStreamSource(source domain.LogStreamSource) bool {
	switch source {
	case domain.LogStreamSourceProcess, domain.LogStreamSourceFile, domain.LogStreamSourcePlugin:
		return true
	default:
		return strings.TrimSpace(string(source)) != ""
	}
}

func validLogStorageBackend(backend domain.LogStorageBackend) bool {
	switch backend {
	case domain.LogStorageBackendLocalSegments, domain.LogStorageBackendLoki, domain.LogStorageBackendClickHouse, domain.LogStorageBackendOpenSearch, domain.LogStorageBackendElasticsearch:
		return true
	default:
		return false
	}
}

func validAuditResult(result domain.AuditResult) bool {
	switch result {
	case domain.AuditResultSuccess, domain.AuditResultDenied, domain.AuditResultFailed, domain.AuditResultQueued:
		return true
	default:
		return false
	}
}