echo "========================================="
echo "  INPUT VALIDATION CHECK"
echo "========================================="

echo ""
echo "--- 1. Division Safety ---"

# Find all division operations in production code
echo "🔍 Scanning for division operations..."
rg " / " src/ --type rust -n | \
  rg -v "test|//|mod |use |impl " | \
  rg -v "\.len\(\) / |as f64 / |as f32 / " > /tmp/divisions.txt

# Check each for guards
echo "Division operations found:"
cat /tmp/divisions.txt | head -20

# Check for .max(1) or similar guards near divisions
echo ""
echo "🔍 Checking for zero-guards near divisions..."
rg "\.max\(1\)|\.max\(1\.0\)|checked_div|if.*==.*0|if.*>.*0" src/ --type rust -n | wc -l
echo "Zero-guard patterns found"

# Specific high-risk patterns: recipe servings, pagination
echo ""
echo "🔍 Checking recipe/nutrition division safety..."
rg "servings|portion|per_serving" src/ --type rust -A 3 | \
  rg " / " | \
  rg -v "\.max\(1\)|checked_div" && \
  echo "⚠️  Division by servings without zero-guard!" || \
  echo "✓ Servings division properly guarded"

echo ""
echo "--- 2. Pagination Bounds ---"

# Check for limit/offset parameters
echo "🔍 Checking pagination parameter bounds..."
rg "struct.*Params|struct.*Request|struct.*Query" src/ --type rust -A 15 | \
  rg "limit|offset|page|per_page" | head -10

# Verify clamp/min/max on pagination values
echo ""
echo "🔍 Checking bound enforcement..."
rg "limit.*clamp|limit.*min|limit.*max|\.min\(.*100\)|\.max\(.*1\)" src/ --type rust -n | head -10
echo "Pagination bound patterns found"

# Check for unbounded LIMIT in SQL
echo ""
echo "🔍 Checking SQL LIMIT bounds..."
rg "LIMIT \\\$|LIMIT \{" src/ --type rust -B 3 | \
  rg -v "clamp|min|max" | head -10
echo "(Above should be empty — all LIMIT values need bounds)"

echo ""
echo "--- 3. Cache Key Completeness ---"

# Find cache key construction
echo "🔍 Checking cache keys include tenant_id..."
rg "cache_key|format!.*cache|format!.*key" src/ --type rust -n | \
  rg -v "tenant" | \
  rg -v "test|//|use " | head -10
echo "(Above should be empty — all cache keys need tenant_id)"

# Verify cache operations use tenant-scoped keys
rg "cache\.get|cache\.set|cache\.insert|cache\.remove" src/ --type rust -B 5 | \
  rg "tenant" | wc -l
echo "Cache operations with tenant context"

echo ""
echo "--- 4. Numeric Range Enforcement ---"

# Check for numeric parameters used without validation
echo "🔍 Checking numeric input validation..."
rg "params\.\w+.*as (f64|f32|i64|i32|u64|u32)" src/ --type rust -n | head -10
echo "(Review above — numeric casts from params need range checks)"

# Check for weight/height/age without bounds
rg "weight|height|age|heart_rate|pace" src/routes/ --type rust -A 5 | \
  rg "params\." | rg -v "validate|clamp|min|max|range" | head -5
echo "(Above should be empty — fitness metrics need bounds)"

echo ""
echo "========================================="
echo "  INPUT VALIDATION CHECK COMPLETE"
echo "========================================="