namespace ZB.MOM.WW.ScadaBridge.Security.Auth;

/// <summary>
/// Startup guard for the dev/test <see cref="AuthDisableLoginOptions.DisableLogin"/> flag.
/// DisableLogin authenticates EVERY request with ALL roles (including Operator+Verifier,
/// nullifying the two-person secured-write control) on a SCADA control surface, so it is
/// refused outside the Development environment unless the operator sets the explicit
/// second acknowledgement key <see cref="AuthDisableLoginOptions.AllowOutsideDevelopment"/>.
/// Called by the Host composition root before AddSecurity(); fail-fast at boot.
/// </summary>
public static class DisableLoginGuard
{
    /// <summary>Throws if <paramref name="disableLogin"/> is set outside Development without the explicit override acknowledgement.</summary>
    /// <param name="disableLogin">The configured <see cref="AuthDisableLoginOptions.DisableLogin"/> flag value.</param>
    /// <param name="environmentName">The current hosting environment name (e.g. <c>Development</c>).</param>
    /// <param name="allowOutsideDevelopment">The configured <see cref="AuthDisableLoginOptions.AllowOutsideDevelopment"/> second acknowledgement flag.</param>
    public static void Validate(bool disableLogin, string environmentName, bool allowOutsideDevelopment)
    {
        if (!disableLogin) return;
        if (string.Equals(environmentName, "Development", StringComparison.OrdinalIgnoreCase)) return;
        if (allowOutsideDevelopment) return;
        throw new InvalidOperationException(
            "ScadaBridge:Security:Auth:DisableLogin=true disables ALL authentication on a SCADA control " +
            $"surface and is refused outside the Development environment (current: '{environmentName}'). " +
            "Remove the flag, run with ASPNETCORE_ENVIRONMENT=Development, or — only if you fully accept an " +
            "unauthenticated deployment — additionally set " +
            "ScadaBridge:Security:Auth:AllowOutsideDevelopment=true.");
    }
}
