using ZB.MOM.WW.Configuration;

namespace ZB.MOM.WW.ScadaBridge.AuditLog.Site;

/// <summary>
/// Validates <see cref="SqliteAuditWriterOptions"/> at host startup
/// (arch-review 08 round 2 NF4). The channel/batch/flush knobs feed the
/// background writer task; a zero anywhere stalls it (nothing drains, nothing
/// flushes). <see cref="SqliteAuditWriterOptions.BacklogPollIntervalSeconds"/>
/// is intentionally NOT validated — a non-positive value has a documented
/// fall-back-to-30s contract in <c>SiteAuditBacklogReporter</c>.
/// </summary>
/// <remarks>
/// <see cref="SqliteAuditWriterOptions.DatabasePath"/> is deliberately NOT
/// validated here (arch-review remediation WP1.2). <c>AddAuditLog</c> runs on
/// BOTH Central and Site composition roots and binds this options type with
/// <c>ValidateOnStart</c> either way, but only Site nodes ever resolve
/// <see cref="SqliteAuditWriter"/> — requiring a non-empty path in this
/// role-agnostic validator would fail Central's boot too. The requirement is
/// instead enforced pre-host, Site-role-only, by <c>StartupValidator</c> in
/// ZB.MOM.WW.ScadaBridge.Host (mirrors how it gates <c>Communication:GrpcPsk</c>).
/// </remarks>
public sealed class SqliteAuditWriterOptionsValidator : OptionsValidatorBase<SqliteAuditWriterOptions>
{
    /// <inheritdoc />
    protected override void Validate(ValidationBuilder builder, SqliteAuditWriterOptions options)
    {
        builder.RequireThat(options.ChannelCapacity > 0,
            $"AuditLog:SiteWriter:{nameof(SqliteAuditWriterOptions.ChannelCapacity)} " +
            $"({options.ChannelCapacity}) must be > 0.");

        builder.RequireThat(options.BatchSize > 0,
            $"AuditLog:SiteWriter:{nameof(SqliteAuditWriterOptions.BatchSize)} " +
            $"({options.BatchSize}) must be > 0.");

        builder.RequireThat(options.FlushIntervalMs > 0,
            $"AuditLog:SiteWriter:{nameof(SqliteAuditWriterOptions.FlushIntervalMs)} " +
            $"({options.FlushIntervalMs}) must be > 0.");

        // BacklogPollIntervalSeconds is deliberately unchecked: a non-positive
        // value falls back to the reporter's 30s default (see the option's
        // remarks + register row 21 resolution).
    }
}