package sql

import (
	"errors"

	"github.com/bcicen/jstream"
	"github.com/minio/simdjson-go"
)

var (
	errKeyLookup                  = errors.New("Cannot look up key in non-object value")
	errIndexLookup                = errors.New("Cannot look up array index in non-array value")
	errWildcardObjectLookup       = errors.New("Object wildcard used on non-object value")

	updatedAt, err := globalBucketMetadataSys.Update(ctx, bucket, bucketPolicyConfig, configData)
	if err != nil {
		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
		return
	}

	// Call site replication hook.
	replLogIf(ctx, globalSiteReplicationSys.BucketMetaHook(ctx, madmin.SRBucketMeta{
		Type:      madmin.SRBucketMetaTypePolicy,
		Bucket:    bucket,
		Policy:    bucketPolicyBytes,
		UpdatedAt: updatedAt,
	}))

				iamLogIf(ctx, fmt.Errorf("Failure in periodic refresh for IAM (took %.2fs): %v", time.Since(refreshStart).Seconds(), err), logger.WarningKind)
			} else {
				took := time.Since(refreshStart).Seconds()
				if took > maxDurationSecondsForLog {
					// Log if we took a lot of time to load.
					logger.Info("IAM refresh took %.2fs", took)
				}
			}

			// Purge expired STS credentials.

	if !ok {
		return errors.New("STS JWT Token has `aud` claim invalid, `aud` must match configured OpenID Client ID")
	}
	if !audValues.Contains(pCfg.ClientID) {
		// if audience claims is missing, look for "azp" claims.
		// OPTIONAL. Authorized party - the party to which the ID
		// Token was issued. If present, it MUST contain the OAuth
		// 2.0 Client ID of this party. This Claim is only needed

		return hex.EncodeToString(sum256[:])
	}

	var (
		defaultSha256Cksum string
		v                  []string
		ok                 bool
	)

	// For a presigned request we look at the query param for sha256.
	if isRequestPresignedSignatureV4(r) {
		// X-Amz-Content-Sha256, if not set in presigned requests, checksum
		// will default to 'UNSIGNED-PAYLOAD'.
		defaultSha256Cksum = unsignedPayload

		participle.Lexer(sqlLexer),
		participle.CaseInsensitive("Keyword"),
		participle.CaseInsensitive("Timeword"),
	)

	j := JSONPath{}
	cases := []string{
		"S3Object",
		"S3Object.id",
		"S3Object.book.title",
		"S3Object.id[1]",
		"S3Object.id['abc']",
		"S3Object.id['ab']",
		"S3Object.words.*.id",
		"S3Object.words.name[*].val",
		"S3Object.words.name[*].val[*]",
		"S3Object.words.name[*].val.*",
	}

		} else {
			fi, onlineMeta, onlineDisks, modTime, etag, err = calcQuorum(metaArr, errs)
		}
		rw.Unlock()
		if err == nil && fi.InlineData() {
			break
		}
	}

	if err != nil {
		// We can only look for dangling if we received all the responses, if we did
		// not we simply ignore it, since we can't tell for sure if its dangling object.
		if totalResp == er.setDriveCount && shouldCheckForDangling(err, errs, bucket) {

			return z.serverPools[poolIdx].CopyObject(ctx, srcBucket, srcObject, dstBucket, dstObject, srcInfo, srcOpts, dstOpts)
		}
		// Destination is versioned, source is not destination version,
		// as a special case look for if the source object is not legacy
		// from older format, for older format we will rewrite them as
		// newer using PutObject() - this is an optimization to save space

	lc := &net.ListenConfig{
		Control: func(network, address string, c syscall.RawConn) error {
			c.Control(func(fdPtr uintptr) {
				if opts.Interface != "" {
					// When interface is specified look for specifically port availability on
					// the specified interface if any.
					_ = syscall.SetsockoptString(int(fdPtr), syscall.SOL_SOCKET, syscall.SO_BINDTODEVICE, opts.Interface)
				}
			})
			return nil
		},
	}

	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		cxml := crossDomainXML
		if globalServerCtxt.CrossDomainXML != "" {
			cxml = globalServerCtxt.CrossDomainXML
		}
		// Look for 'crossdomain.xml' in the incoming request.
		if r.URL.Path == crossDomainXMLEntity {
			// Write the standard cross domain policy xml.
			w.Write([]byte(cxml))
			// Request completed, no need to serve to other handlers.