using System.Collections.Generic;

namespace ZB.MOM.WW.OtOpcUa.Host.Configuration
{
    /// <summary>
    ///     Transport security settings that control which OPC UA security profiles the server exposes and how client
    ///     certificates are handled.
    /// </summary>
    public class SecurityProfileConfiguration
    {
        /// <summary>
        ///     Gets or sets the list of security profile names to expose as server endpoints.
        ///     Valid values: "None", "Basic256Sha256-Sign", "Basic256Sha256-SignAndEncrypt".
        ///     Defaults to ["None"] for backward compatibility.
        /// </summary>
        public List<string> Profiles { get; set; } = new() { "None" };

        /// <summary>
        ///     Gets or sets a value indicating whether the server automatically accepts client certificates
        ///     that are not in the trusted store. Should be <see langword="false" /> in production.
        /// </summary>
        public bool AutoAcceptClientCertificates { get; set; } = true;

        /// <summary>
        ///     Gets or sets a value indicating whether client certificates signed with SHA-1 are rejected.
        /// </summary>
        public bool RejectSHA1Certificates { get; set; } = true;

        /// <summary>
        ///     Gets or sets the minimum RSA key size required for client certificates.
        /// </summary>
        public int MinimumCertificateKeySize { get; set; } = 2048;

        /// <summary>
        ///     Gets or sets an optional override for the PKI root directory.
        ///     When <see langword="null" />, defaults to <c>%LOCALAPPDATA%\OPC Foundation\pki</c>.
        /// </summary>
        public string? PkiRootPath { get; set; }

        /// <summary>
        ///     Gets or sets an optional override for the server certificate subject name.
        ///     When <see langword="null" />, defaults to <c>CN={ServerName}, O=ZB MOM, DC=localhost</c>.
        /// </summary>
        public string? CertificateSubject { get; set; }

        /// <summary>
        ///     Gets or sets the lifetime of the auto-generated server certificate in months.
        ///     Defaults to 60 months (5 years).
        /// </summary>
        public int CertificateLifetimeMonths { get; set; } = 60;
    }
}