namespace ZB.MOM.WW.ScadaBridge.InboundAPI;

public class InboundApiOptions
{
    /// <summary>
    /// Default cap on the inbound API request body, in bytes.
    /// </summary>
    public const long DefaultMaxRequestBodyBytes = 1L * 1024 * 1024; // 1 MiB

    /// <summary>Default timeout for inbound API method execution before the request is cancelled.</summary>
    public TimeSpan DefaultMethodTimeout { get; set; } = TimeSpan.FromSeconds(30);

    /// <summary>
    /// Maximum accepted request body size for <c>POST /api/{methodName}</c>.
    /// Requests whose body exceeds this are rejected with HTTP 413 before being
    /// buffered into a <see cref="System.Text.Json.JsonDocument"/>. The inbound API
    /// has no rate limiting (a deliberate design choice), so an explicit, modest cap
    /// bounds per-request allocations.
    /// </summary>
    public long MaxRequestBodyBytes { get; set; } = DefaultMaxRequestBodyBytes;

    /// <summary>
    /// Server-side HMAC pepper for inbound-API bearer credentials, bound from
    /// <c>ScadaBridge:InboundApi:ApiKeyPepper</c>.
    /// <para>
    /// Auth re-arch: the legacy SQL Server hashing path that consumed this
    /// property was retired. The pepper itself is still required — the shared
    /// ZB.MOM.WW.Auth.ApiKeys verifier reads the SAME configuration key
    /// (<c>PepperSecretName</c> in the Host composition root points at it) to pepper
    /// the SQLite-stored keys. It is a secret: supply a strong, random value
    /// (≥ 16 characters), DIFFERENT per environment, via a secret store and never
    /// hard-coded. This property is retained so the section still binds cleanly; the
    /// value is consumed by the library verifier, not by <c>AddInboundAPI</c>.
    /// </para>
    /// </summary>
    public string ApiKeyPepper { get; set; } = string.Empty;

    /// <summary>
    /// WP2.6b (arch-review misc — Inbound API per-request SQL): how long a resolved
    /// <c>ApiMethod</c> row (found OR not-found) is served from <see cref="ApiMethodCache"/>
    /// before the next request re-fetches it from the repository. The
    /// <c>ScriptArtifactChangeSubscriber</c>/<c>IScriptArtifactChangeBus</c> pipeline
    /// invalidates a specific method's entry immediately on a bundle-import change (the fast
    /// path); this TTL is the self-healing fallback for changes the bus does not cover (e.g.
    /// an operator edit via the Management API/UI, which does not publish a bus notification),
    /// bounding staleness without requiring every mutation path to remember to invalidate.
    /// Short by design — the whole point is to absorb repeated-request-storm SQL, not to
    /// serve minutes-old method definitions.
    /// </summary>
    public TimeSpan ApiMethodCacheTtl { get; set; } = TimeSpan.FromSeconds(5);
}
