namespace ZB.MOM.WW.ScadaBridge.Security.Auth;

/// <summary>
/// Dev/test flag: when <see cref="DisableLogin"/> is true the Central UI bypasses the login
/// form entirely and auto-authenticates EVERY request as <see cref="User"/> with ALL roles,
/// system-wide. Default OFF. This disables authentication on a SCADA control surface —
/// dev/test ONLY; never enable in production.
/// </summary>
public sealed class AuthDisableLoginOptions
{
    /// <summary>
    /// Configuration section name (<c>ScadaBridge:Security:Auth</c>).
    /// This is a CHILD sub-section of <c>ScadaBridge:Security</c> (where
    /// <see cref="SecurityOptions"/> binds the parent fields) — not a sibling.
    /// In appsettings.json nest it under the existing <c>Security</c> object:
    /// <code>
    /// "ScadaBridge": { "Security": { "Auth": { "DisableLogin": true } } }
    /// </code>
    /// </summary>
    public const string SectionName = "ScadaBridge:Security:Auth";

    /// <summary>When true, disable login and auto-authenticate every request. Default false.</summary>
    public bool DisableLogin { get; set; }

    /// <summary>The username the auto-login principal is minted with. Default "multi-role".</summary>
    public string User { get; set; } = "multi-role";

    /// <summary>Explicit second acknowledgement key: permits DisableLogin outside Development. Default false.</summary>
    public bool AllowOutsideDevelopment { get; set; }
}
