namespace ZB.MOM.WW.ScadaBridge.Security;

/// <summary>
/// Non-LDAP security configuration: the cookie-embedded JWT signing/lifetime
/// settings and the session idle-timeout / cookie-security policy.
/// </summary>
/// <remarks>
/// Task 1.2/1.4 cutover: the LDAP connection settings that used to live here as
/// flat <c>Ldap*</c> keys (server, port, transport, search base, service account,
/// attributes, timeout) moved into a nested <c>ScadaBridge:Security:Ldap</c>
/// sub-section bound to the shared <c>ZB.MOM.WW.Auth.Abstractions.Ldap.LdapOptions</c>
/// and registered via <c>AddZbLdapAuth</c>. This is a BREAKING config-key change —
/// see CHANGELOG. The non-LDAP fields below are unchanged and still bound from
/// <c>ScadaBridge:Security</c>.
/// </remarks>
public class SecurityOptions
{
    /// <summary>
    /// Symmetric HMAC-SHA256 signing key for cookie-embedded JWTs. Must be at least
    /// 32 bytes (256 bits) — validated at <see cref="JwtTokenService"/> construction.
    /// </summary>
    public string JwtSigningKey { get; set; } = string.Empty;

    /// <summary>
    /// Minimum signing-key length in bytes required for HMAC-SHA256 (256 bits).
    /// </summary>
    public const int MinJwtSigningKeyBytes = 32;
    /// <summary>Cookie-embedded JWT lifetime in minutes before it must be refreshed.</summary>
    public int JwtExpiryMinutes { get; set; } = 15;
    /// <summary>Session idle timeout in minutes; sessions inactive beyond this are expired.</summary>
    public int IdleTimeoutMinutes { get; set; } = 30;

    /// <summary>
    /// Minutes before token expiry to trigger refresh.
    /// </summary>
    public int JwtRefreshThresholdMinutes { get; set; } = 5;

    /// <summary>
    /// When true (default) the authentication cookie is always marked
    /// <c>Secure</c> (sent only over HTTPS) — the correct production setting,
    /// since the cookie carries the embedded JWT bearer credential. Set false
    /// for an HTTP-only deployment such as the local Docker dev cluster: the
    /// cookie then uses <c>SameAsRequest</c>, so it is still <c>Secure</c> on
    /// any HTTPS request but is usable over plain HTTP.
    /// </summary>
    public bool RequireHttpsCookie { get; set; } = true;

    /// <summary>The canonical default authentication-cookie name (<see cref="CookieName"/>).</summary>
    public const string DefaultCookieName = "ZB.MOM.WW.ScadaBridge.Auth";

    /// <summary>
    /// Authentication cookie name. Defaults to <see cref="DefaultCookieName"/>. Override it
    /// (<c>ScadaBridge:Security:CookieName</c>) to give a distinct name to a deployment that
    /// shares a hostname with another ScadaBridge environment — browser cookies are scoped by
    /// host+path but NOT by port, so two clusters on the same host (e.g. two local Docker
    /// stacks on <c>localhost:9000</c> and <c>localhost:9100</c>) would otherwise clobber each
    /// other's session under a shared cookie name. A blank/whitespace value falls back to
    /// <see cref="DefaultCookieName"/>. Changing this invalidates existing sessions on next deploy.
    /// </summary>
    public string CookieName { get; set; } = DefaultCookieName;
}
