# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-defend-against-demand-side-rate-limit-attacks-from-malicious-peers.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-defend-against-demand-side-rate-limit-attacks-from-malicious-peers.warrant.json
# Markdown SHA-256:   333f21670f42758611137a85105c90952f0cdcb648b5b4bde52d4f76e79246ed
# Code AST SHA-256:   46bee51ea91955cafdc5db143dc6fa7f82ab583869b09afe06325cdc4dac7559
# Verified Classes:   RateLimitVerdict, ServiceRequest, RateLimitPolicy, RateLimitManifest, DemandSideAttackGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class RateLimitVerdict(Enum):
    NO_RATE_LIMIT = auto()
    LEGITIMATE_WITHIN_LIMIT = auto()
    LEGITIMATE_THROTTLED = auto()
    ATTACKER_THROTTLED = auto()

@dataclass(frozen=True)
class ServiceRequest:
    request_id: str
    peer_id: str
    is_attributable: bool
    peer_historical_value_ratio: float
    attack_indicators_count: int
    peer_stake_verified: bool

@dataclass(frozen=True)
class RateLimitPolicy:
    attacker_threshold_indicators: int
    min_value_ratio_for_legitimate: float

@dataclass(frozen=True)
class RateLimitManifest:
    verdict: RateLimitVerdict
    directive: str
    manifest_digest: str

class DemandSideAttackGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_request(
        cls, request: ServiceRequest, policy: RateLimitPolicy
    ) -> RateLimitManifest:
        
        # Gate 1: Not attributable
        if not request.is_attributable:
            digest = cls._hash(json.dumps({
                "request": request.request_id,
                "type": "UNATTRIBUTABLE"
            }, sort_keys=True))
            return RateLimitManifest(
                verdict=RateLimitVerdict.LEGITIMATE_WITHIN_LIMIT,
                directive=f"PROCEED: Request {request.request_id} unattributable, apply aggregate limit.",
                manifest_digest=digest
            )

        # Gate 2: Attacker indicators
        if request.attack_indicators_count >= policy.attacker_threshold_indicators:
            return RateLimitManifest(
                verdict=RateLimitVerdict.ATTACKER_THROTTLED,
                directive=f"THROTTLE_ATTACKER: {request.attack_indicators_count} indicators for {request.peer_id}.",
                manifest_digest=cls._hash(f"ATTACKER:{request.peer_id}")
            )

        # Gate 3: Low value without stake
        if request.peer_historical_value_ratio < policy.min_value_ratio_for_legitimate and not request.peer_stake_verified:
            return RateLimitManifest(
                verdict=RateLimitVerdict.LEGITIMATE_THROTTLED,
                directive=f"THROTTLE: Low value ratio {request.peer_historical_value_ratio:.2f} without stake for {request.peer_id}.",
                manifest_digest=cls._hash(f"LOW_VALUE:{request.peer_id}")
            )

        # Gate 4: Legitimate within limit
        digest = cls._hash(json.dumps({
            "request": request.request_id,
            "peer": request.peer_id,
            "value_ratio": f"{request.peer_historical_value_ratio:.3f}",
            "stake": request.peer_stake_verified
        }, sort_keys=True))
        
        return RateLimitManifest(
            verdict=RateLimitVerdict.LEGITIMATE_WITHIN_LIMIT,
            directive=f"PROCEED: Request {request.request_id} from {request.peer_id} within limit.",
            manifest_digest=digest
        )