import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InvalidClassException;
import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;

public class FilterDeserialisasi {

    // Dua record serializable sederhana untuk demonstrasi.
    record Tugas(String judul, int prioritas) implements Serializable { }
    record Catatan(String isi) implements Serializable { }

    public static void main(String[] args) throws Exception {
        byte[] dataTugas;
        try (var keluar = new ByteArrayOutputStream();
             var oos = new ObjectOutputStream(keluar)) {
            oos.writeObject(new Tugas("Backup harian", 1));
            dataTugas = keluar.toByteArray();
        }
        byte[] dataCatatan;
        try (var keluar = new ByteArrayOutputStream();
             var oos = new ObjectOutputStream(keluar)) {
            oos.writeObject(new Catatan("rapat jam 9"));
            dataCatatan = keluar.toByteArray();
        }
        System.out.println("ukuran stream Tugas  : " + dataTugas.length + " byte");
        System.out.println("ukuran stream Catatan: " + dataCatatan.length + " byte");

        // Filter JEP 290: hanya class Tugas yang boleh direkonstruksi;
        // class lain apapun langsung ditolak (fail closed).
        ObjectInputFilter hanyaTugas = ObjectInputFilter.allowFilter(
                kelas -> Tugas.class.equals(kelas),
                ObjectInputFilter.Status.REJECTED);

        try (var ois = new ObjectInputStream(new ByteArrayInputStream(dataTugas))) {
            ois.setObjectInputFilter(hanyaTugas);
            Object hasil = ois.readObject();
            System.out.println("Tugas diterima : " + hasil);
        }
        try (var ois = new ObjectInputStream(new ByteArrayInputStream(dataCatatan))) {
            ois.setObjectInputFilter(hanyaTugas);
            try {
                Object hasil = ois.readObject();
                System.out.println("Catatan diterima: " + hasil);
            } catch (InvalidClassException e) {
                System.out.println("Catatan DITOLAK : " + e.getMessage());
            }
        }
    }
}