// ExperimentationOptOut: cutoff() returns this sentinel where it throws today.
static final Instant INVALID_CUTOFF = Instant.MIN;

// ExperimentationOptOut.excludes: an invalid cutoff excludes every exposure-logging allocation.
if (cutoff == INVALID_CUTOFF) {
  return Boolean.TRUE.equals(allocation.doLog);
}

package com.datadog.openfeature.internal.ufc;

import java.time.DateTimeException;
import java.time.Instant;
import java.time.LocalDate;
import java.time.ZoneOffset;
import javax.annotation.Nullable;

/**
 * Contract timestamp grammar (D005-D007) shared by the subject cutoff and allocation activation.
 */
public final class OptOutTimestamps {
  private OptOutTimestamps() {}

  /** Returns the instant, or null when {@code s} is outside the contract grammar. */
  @Nullable
  public static Instant parse(final String s) {
    final int n = s.length();
    if (n < 20
        || s.charAt(4) != '-'
        || s.charAt(7) != '-'
        || (s.charAt(10) != 'T' && s.charAt(10) != 't')
        || s.charAt(13) != ':'
        || s.charAt(16) != ':') {
      return null;
    }
    final int year = digits(s, 0, 4);
    final int month = digits(s, 5, 7);
    final int day = digits(s, 8, 10);
    final int hour = digits(s, 11, 13);
    final int minute = digits(s, 14, 16);
    final int second = digits(s, 17, 19);
    if (year < 0
        || month < 0
        || day < 0
        || hour < 0
        || hour > 23
        || minute < 0
        || minute > 59
        || second < 0
        || second > 59) {
      return null;
    }
    int i = 19;
    int nanos = 0;
    if (s.charAt(i) == '.') {
      final int start = ++i;
      int scale = 100_000_000;
      while (i < n && s.charAt(i) >= '0' && s.charAt(i) <= '9') {
        nanos += (s.charAt(i) - '0') * scale; // truncate beyond 9 digits
        scale /= 10;
        i++;
      }
      if (i == start) {
        return null;
      }
    }
    final int offsetSeconds;
    final int rest = n - i;
    if (rest == 1 && (s.charAt(i) == 'Z' || s.charAt(i) == 'z')) {
      offsetSeconds = 0;
    } else if (rest == 6 && (s.charAt(i) == '+' || s.charAt(i) == '-') && s.charAt(i + 3) == ':') {
      final int oh = digits(s, i + 1, i + 3);
      final int om = digits(s, i + 4, i + 6);
      if (oh < 0 || oh > 23 || om < 0 || om > 59) {
        return null;
      }
      offsetSeconds = (s.charAt(i) == '-' ? -1 : 1) * (oh * 3600 + om * 60);
    } else {
      return null;
    }
    final Instant instant;
    try {
      instant =
          LocalDate.of(year, month, day)
              .atTime(hour, minute, second, nanos)
              .toInstant(ZoneOffset.UTC)
              .minusSeconds(offsetSeconds);
    } catch (final DateTimeException e) {
      return null;
    }
    final int utcYear = instant.atOffset(ZoneOffset.UTC).getYear();
    return utcYear < 0 || utcYear > 9999 ? null : instant;
  }

  private static int digits(final String s, final int from, final int to) {
    int v = 0;
    for (int i = from; i < to; i++) {
      final char c = s.charAt(i);
      if (c < '0' || c > '9') {
        return -1;
      }
      v = v * 10 + (c - '0');
    }
    return v;
  }
}

    if (value != null && value.isString()) {
      final Instant cutoff = OptOutTimestamps.parse(value.asString());
      if (cutoff != null) {
        return cutoff;
      }
    }
    throw new IllegalArgumentException(INVALID_TIMESTAMP);

  static Stream<Arguments> timestampCorpus() throws IOException {
    final List<Arguments> cases = new ArrayList<>();
    final byte[] corpus;
    try (InputStream in =
        ExperimentationOptOutTest.class.getResourceAsStream(
            "/experimentation-opt-out-timestamps.jsonl")) {
      corpus = readAll(in);
    }
    for (final String line : new String(corpus, UTF_8).split("\n")) {
      if (!line.trim().isEmpty()) {
        final Map<String, Object> row = JsonReading.readObject(line);
        cases.add(Arguments.of(row.get("id"), row.get("input"), row.get("expected")));
      }
    }
    return cases.stream();
  }

  private static byte[] readAll(final InputStream in) throws IOException {
    final ByteArrayOutputStream out = new ByteArrayOutputStream();
    final byte[] buffer = new byte[8192];
    for (int n; (n = in.read(buffer)) != -1; ) {
      out.write(buffer, 0, n);
    }
    return out.toByteArray();
  }

  @ParameterizedTest(name = "{0}")
  @MethodSource("timestampCorpus")
  void timestampGrammarMatchesSharedCorpus(
      final String id, final String input, final Map<String, Object> expected) {
    final MutableContext context = new MutableContext().add(ExperimentationOptOut.ATTRIBUTE, input);
    if (Boolean.TRUE.equals(expected.get("accepted"))) {
      assertEquals(
          Instant.ofEpochSecond(
              ((Number) expected.get("seconds")).longValue(),
              ((Number) expected.get("nanos")).longValue()),
          ExperimentationOptOut.cutoff(ExperimentationOptOutMode.IMMEDIATE, context));
    } else {
      assertThrows(
          IllegalArgumentException.class,
          () -> ExperimentationOptOut.cutoff(ExperimentationOptOutMode.IMMEDIATE, context));
    }
  }

  // An unsupported mode does not stop construction when Feature Flags is disabled.
  @Test
  void disabledFeatureFlagsDoNotValidateMode() {
    final String[][] properties = {
      {"dd.feature.flags.enabled", "false"},
      {"dd.feature.flags.experimentation.opt.out.mode", "unsupported"}
    };
    final String[] previous = new String[properties.length];
    for (int i = 0; i < properties.length; i++) {
      previous[i] = System.setProperty(properties[i][0], properties[i][1]);
    }
    try {
      assertDoesNotThrow(() -> new Provider().shutdown());
    } finally {
      for (int i = 0; i < properties.length; i++) {
        if (previous[i] == null) {
          System.clearProperty(properties[i][0]);
        } else {
          System.setProperty(properties[i][0], previous[i]);
        }
      }
    }
  }

  // A disabled flag reports DISABLED before activation timestamps are checked, as in libdatadog.
  @Test
  void disabledFlagReportsDisabledBeforeInvalidActivation() throws Exception {
    final ProviderEvaluation<String> result =
        evaluate(
            configuration(false, "\"bad\""),
            ExperimentationOptOutMode.FUTURE_EXPERIMENTS_ONLY,
            new MutableContext("subject").add(ATTRIBUTE, CUTOFF));
    assertNull(result.getErrorCode());
    assertEquals(Reason.DISABLED.name(), result.getReason());
    assertEquals("default", result.getValue());
  }

package com.datadog.openfeature;

import static java.nio.charset.StandardCharsets.UTF_8;
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNull;

import com.datadog.openfeature.internal.bridge.v1.AgentBridge;
import com.datadog.openfeature.internal.config.TestSettings;
import com.datadog.openfeature.internal.ufc.UniversalFlagConfigParser;
import dev.openfeature.sdk.ErrorCode;
import dev.openfeature.sdk.MutableContext;
import dev.openfeature.sdk.MutableStructure;
import dev.openfeature.sdk.ProviderEvaluation;
import dev.openfeature.sdk.Reason;
import dev.openfeature.sdk.Value;
import java.time.Instant;
import java.util.Arrays;
import java.util.Collections;
import java.util.stream.Stream;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.EnumSource;
import org.junit.jupiter.params.provider.MethodSource;

/** Pins opt-out behavior the policy corpus does not reach. */
class ExperimentationOptOutGapTest {
  private static final String ATTRIBUTE = "dd_experimentation_opt_out_at";
  private static final String CUTOFF = "2026-10-19T12:00:00Z";

  /** The experiment allocation is sharded and has a numeric rule; the ordinary one is neither. */
  private static String configuration(final boolean enabled, final String activation) {
    final String experiment =
        "{\"key\":\"experiment\",\"doLog\":true"
            + (activation == null ? "" : ",\"randomizationActivatedAt\":" + activation)
            + ",\"rules\":[{\"conditions\":[{\"attribute\":\"age\",\"operator\":\"GT\",\"value\":18}]}]"
            + ",\"splits\":[{\"variationKey\":\"experiment\",\"shards\":[{\"salt\":\"s\",\"totalShards\":10000,"
            + "\"ranges\":[{\"start\":0,\"end\":10000}]}]}]}";
    final String ordinary =
        "{\"key\":\"ordinary\",\"doLog\":false,\"splits\":[{\"variationKey\":\"ordinary\",\"shards\":[]}]}";
    return "{\"flags\":{\"target\":{\"key\":\"target\",\"enabled\":"
        + enabled
        + ",\"variationType\":\"STRING\",\"variations\":{"
        + "\"experiment\":{\"key\":\"experiment\",\"value\":\"experiment\"},"
        + "\"ordinary\":{\"key\":\"ordinary\",\"value\":\"ordinary\"}},"
        + "\"allocations\":["
        + experiment
        + ","
        + ordinary
        + "]}}}";
  }

  private static ProviderEvaluation<String> evaluate(
      final String json, final ExperimentationOptOutMode mode, final MutableContext context)
      throws Exception {
    final DDEvaluator evaluator =
        new DDEvaluator(() -> {}, AgentBridge.NONE, TestSettings.of(), mode);
    evaluator.accept(UniversalFlagConfigParser.parse(json.getBytes(UTF_8)));
    return evaluator.evaluate(String.class, "target", "default", context);
  }

  // Exclusion happens before randomization: a skipped allocation needs no targeting key.
  @ParameterizedTest
  @EnumSource(
      value = ExperimentationOptOutMode.class,
      names = {"IMMEDIATE", "FUTURE_EXPERIMENTS_ONLY"})
  void excludedAllocationSkipsShardingWithoutTargetingKey(final ExperimentationOptOutMode mode)
      throws Exception {
    final MutableContext context = new MutableContext().add(ATTRIBUTE, CUTOFF).add("age", 30);
    final ProviderEvaluation<String> result = evaluate(configuration(true, null), mode, context);
    assertNull(result.getErrorCode());
    assertEquals("ordinary", result.getValue());
    // Control: without opt-out the experiment's shards need the targeting key.
    final ProviderEvaluation<String> control =
        evaluate(configuration(true, null), ExperimentationOptOutMode.DISABLED, context);
    assertEquals(ErrorCode.TARGETING_KEY_MISSING, control.getErrorCode());
  }

  // Exclusion happens before targeting: a skipped allocation's rules are never evaluated.
  @ParameterizedTest
  @EnumSource(
      value = ExperimentationOptOutMode.class,
      names = {"IMMEDIATE", "FUTURE_EXPERIMENTS_ONLY"})
  void excludedAllocationRulesAreNotEvaluated(final ExperimentationOptOutMode mode)
      throws Exception {
    final MutableContext context =
        new MutableContext("subject").add(ATTRIBUTE, CUTOFF).add("age", "not-a-number");
    final ProviderEvaluation<String> result = evaluate(configuration(true, null), mode, context);
    assertNull(result.getErrorCode());
    assertEquals("ordinary", result.getValue());
    final ProviderEvaluation<String> control =
        evaluate(configuration(true, null), ExperimentationOptOutMode.DISABLED, context);
    assertEquals(ErrorCode.TYPE_MISMATCH, control.getErrorCode());
  }

  // A disabled flag reports DISABLED before activation timestamps are checked, as in libdatadog.
  @Test
  void disabledFlagReportsDisabledBeforeInvalidActivation() throws Exception {
    final ProviderEvaluation<String> result =
        evaluate(
            configuration(false, "\"bad\""),
            ExperimentationOptOutMode.FUTURE_EXPERIMENTS_ONLY,
            new MutableContext("subject").add(ATTRIBUTE, CUTOFF));
    assertNull(result.getErrorCode());
    assertEquals(Reason.DISABLED.name(), result.getReason());
    assertEquals("default", result.getValue());
  }

  static Stream<Arguments> nonStringAttributes() {
    return Stream.of(
        Arguments.of("Instant", new Value(Instant.parse(CUTOFF))),
        Arguments.of("double", new Value(1.5)),
        Arguments.of("structure", new Value(new MutableStructure().add("at", CUTOFF))),
        Arguments.of("list", new Value(Collections.singletonList(new Value(CUTOFF)))),
        Arguments.of("empty list", new Value(Arrays.asList())),
        Arguments.of("null value", new Value()));
  }

  // Any present non-string value is INVALID_CONTEXT, including a java.time.Instant.
  @ParameterizedTest(name = "{0}")
  @MethodSource("nonStringAttributes")
  void nonStringAttributeIsInvalidContextOnlyWhenEnabled(final String name, final Value value)
      throws Exception {
    for (final ExperimentationOptOutMode mode : ExperimentationOptOutMode.values()) {
      final MutableContext context =
          new MutableContext("subject", Collections.singletonMap(ATTRIBUTE, value));
      final ProviderEvaluation<String> result =
          evaluate(configuration(true, "\"2026-01-01T00:00:00Z\""), mode, context);
      if (mode == ExperimentationOptOutMode.IMMEDIATE
          || mode == ExperimentationOptOutMode.FUTURE_EXPERIMENTS_ONLY) {
        assertEquals(ErrorCode.INVALID_CONTEXT, result.getErrorCode(), name + " " + mode);
        assertEquals("default", result.getValue(), name + " " + mode);
      } else {
        // The age rule does not match, so the subject falls through to ordinary.
        assertNull(result.getErrorCode(), name + " " + mode);
        assertEquals("ordinary", result.getValue(), name + " " + mode);
      }
    }
  }

  // An unsupported mode does not stop construction when Feature Flags is disabled.
  @Test
  void disabledFeatureFlagsDoNotValidateMode() {
    final String[][] properties = {
      {"dd.feature.flags.enabled", "false"},
      {"dd.feature.flags.experimentation.opt.out.mode", "unsupported"}
    };
    final String[] previous = new String[properties.length];
    for (int i = 0; i < properties.length; i++) {
      previous[i] = System.setProperty(properties[i][0], properties[i][1]);
    }
    try {
      assertDoesNotThrow(() -> new Provider().shutdown());
    } finally {
      for (int i = 0; i < properties.length; i++) {
        if (previous[i] == null) {
          System.clearProperty(properties[i][0]);
        } else {
          System.setProperty(properties[i][0], previous[i]);
        }
      }
    }
  }
}

// ExperimentationOptOutMode: delete DEFAULT.

// Provider.Options
private ExperimentationOptOutMode experimentationOptOutMode; // null: read configuration

/**
 * Sets per-subject experimentation opt-out. Overrides
 * {@code DD_FEATURE_FLAGS_EXPERIMENTATION_OPT_OUT_MODE}. Without an explicit option, the provider
 * reads configuration at construction. Disabled by default.
 */
public Options experimentationOptOutMode(final ExperimentationOptOutMode mode) {
  this.experimentationOptOutMode = requireNonNull(mode, "mode");
  return this;
}

// ExperimentationOptOut.resolve: drop requireNonNull(override, …), then
if (override != null) {
  return override;
}