interface SecurityConfig {
  allowedFields?: string[];
  allowedRelations?: string[];
  maxLimit?: number;
  operators?: FilterOperator[];
  defaultLimit?: number;
  defaultPage?: number;
}

import { createQueryBuilder, createDrizzlePgCompiler } from '@qbjs/core';

const builder = createQueryBuilder({
  config: {
    allowedFields: ['id', 'name', 'email', 'createdAt'],
    maxLimit: 50,
    operators: ['eq', 'ne', 'contains', 'containsi', 'gt', 'lt', 'gte', 'lte'],
    defaultLimit: 20,
  },
  compiler: createDrizzlePgCompiler(),
});

const DEFAULT_SECURITY_CONFIG: ResolvedSecurityConfig = {
  allowedFields: [],      // Empty means all fields allowed
  allowedRelations: [],   // Empty means all relations allowed
  maxLimit: 100,
  operators: [...FILTER_OPERATORS], // All operators allowed
  defaultLimit: 10,
  defaultPage: 1,
};

import { resolveSecurityConfig } from '@qbjs/core';

const config = resolveSecurityConfig({
  allowedFields: ['id', 'name'],
  maxLimit: 50,
});

console.log(config.allowedFields);  // ['id', 'name']
console.log(config.maxLimit);       // 50
console.log(config.defaultLimit);   // 10 (from defaults)

import { validateSecurity } from '@qbjs/core';

const result = validateSecurity(ast, {
  allowedFields: ['id', 'name', 'email'],
  maxLimit: 50,
});

if (!result.valid) {
  console.log(result.errors);
}

// Use the potentially modified AST (e.g., with capped limit)
const validatedAst = result.ast;

interface SecurityValidationResult {
  valid: boolean;
  errors: SecurityError[];
  warnings: SecurityWarning[];
  ast: QueryAST | null;
}

import { validateFields } from '@qbjs/core';

const errors = validateFields(
  ['id', 'name', 'password'],  // requested fields
  ['id', 'name', 'email']      // allowed fields
);

// errors will contain an error for 'password'

import { validateLimit } from '@qbjs/core';

const { limit, warning } = validateLimit(200, 100);

console.log(limit);    // 100 (capped)
console.log(warning);  // SecurityWarning about capping

{ limit: number; warning: SecurityWarning | null }

import { validateOperators } from '@qbjs/core';

const errors = validateOperators(
  filterNode,
  ['eq', 'ne', 'contains']  // allowed operators
);

import { validateFilterFields } from '@qbjs/core';

const errors = validateFilterFields(
  filterNode,
  ['id', 'name', 'email']  // allowed fields
);

import { validateSortFields } from '@qbjs/core';

const errors = validateSortFields(
  [{ field: 'createdAt', direction: 'desc' }],
  ['id', 'name', 'createdAt']  // allowed fields
);

import { extractFilterFields } from '@qbjs/core';

const fields = extractFilterFields(filterNode);
// ['status', 'title', 'createdAt']

interface SecurityError {
  code: 'FIELD_NOT_ALLOWED' | 'OPERATOR_NOT_ALLOWED' | 'LIMIT_EXCEEDED';
  field: string;
  message: string;
  path: string[];
}

interface SecurityWarning {
  code: 'LIMIT_CAPPED';
  field: string;
  message: string;
  originalValue: number;
  cappedValue: number;
}

import { 
  parse, 
  validateSecurity,
  createQueryBuilder,
  createDrizzlePgCompiler 
} from '@qbjs/core';

// Option 1: Manual validation
const parseResult = parse({
  fields: 'id,name,password',
  filter: { status: { eq: 'active' } },
  limit: '200'
});

const securityResult = validateSecurity(parseResult.ast, {
  allowedFields: ['id', 'name', 'email', 'status'],
  maxLimit: 100,
  operators: ['eq', 'ne', 'contains']
});

if (!securityResult.valid) {
  console.log('Security errors:', securityResult.errors);
  // [{ code: 'FIELD_NOT_ALLOWED', field: 'password', ... }]
}

if (securityResult.warnings.length > 0) {
  console.log('Security warnings:', securityResult.warnings);
  // [{ code: 'LIMIT_CAPPED', originalValue: 200, cappedValue: 100, ... }]
}

// Option 2: Automatic validation via QueryBuilder
const builder = createQueryBuilder({
  config: {
    allowedFields: ['id', 'name', 'email', 'status'],
    maxLimit: 100,
    operators: ['eq', 'ne', 'contains']
  },
  compiler: createDrizzlePgCompiler()
});

// Security validation is applied automatically
const result = builder.parse({
  fields: 'id,name,password',
  filter: { status: { eq: 'active' } },
  limit: '200'
});

// result.errors will contain security errors
// result.warnings will contain security warnings