using ZB.MOM.WW.Configuration;

namespace ZB.MOM.WW.ScadaBridge.InboundAPI;

/// <summary>
/// Validates <see cref="InboundApiOptions"/> at startup. <see cref="InboundApiOptions.DefaultMethodTimeout"/>
/// bounds each inbound-API method execution and <see cref="InboundApiOptions.MaxRequestBodyBytes"/> caps the
/// accepted <c>POST /api/{methodName}</c> body before it is buffered — a zero/negative timeout would cancel
/// every request immediately (or never), and a non-positive body cap would reject every request with HTTP 413.
/// Registered with <c>ValidateOnStart()</c> so a bad <c>ScadaBridge:InboundApi</c> section fails fast at boot
/// with a clear, key-naming message rather than degrading the endpoint at runtime.
/// <para>
/// <see cref="InboundApiOptions.ApiKeyPepper"/> is intentionally NOT validated here: an empty pepper is a
/// legitimate dev default, and production pepper strength is owned by the shared auth-key library / startup
/// validator, not by this options validator.
/// </para>
/// </summary>
public sealed class InboundApiOptionsValidator : OptionsValidatorBase<InboundApiOptions>
{
    /// <inheritdoc />
    protected override void Validate(ValidationBuilder builder, InboundApiOptions options)
    {
        builder.RequireThat(options.DefaultMethodTimeout > TimeSpan.Zero,
            $"ScadaBridge:InboundApi:DefaultMethodTimeout must be a positive duration " +
            $"(was {options.DefaultMethodTimeout}); it bounds each inbound-API method execution.");

        builder.RequireThat(options.MaxRequestBodyBytes > 0,
            $"ScadaBridge:InboundApi:MaxRequestBodyBytes must be greater than zero " +
            $"(was {options.MaxRequestBodyBytes}); it caps the accepted request body before buffering.");

        builder.RequireThat(options.ApiMethodCacheTtl > TimeSpan.Zero,
            $"ScadaBridge:InboundApi:ApiMethodCacheTtl must be a positive duration " +
            $"(was {options.ApiMethodCacheTtl}); it bounds how long a resolved ApiMethod row is cached.");

        builder.RequireThat(options.StandbyForwardTimeout > TimeSpan.Zero,
            $"ScadaBridge:InboundApi:StandbyForwardTimeout must be a positive duration " +
            $"(was {options.StandbyForwardTimeout}); it bounds each standby→active relay attempt.");

        foreach (var peer in options.StandbyForwardPeerEndpoints)
        {
            var ok = Uri.TryCreate(peer, UriKind.Absolute, out var uri)
                && (uri.Scheme == Uri.UriSchemeHttp || uri.Scheme == Uri.UriSchemeHttps);
            builder.RequireThat(ok,
                $"ScadaBridge:InboundApi:StandbyForwardPeerEndpoints entry '{peer}' must be an absolute " +
                $"http/https URL (e.g. http://central-b:5000); it is the peer a standby relays inbound API calls to.");
        }
    }
}