using Microsoft.Extensions.Configuration;

namespace ZB.MOM.WW.OtOpcUa.Host.OpcUa;

/// <summary>
///     The pre-authentication guards <see cref="BoundedApiKeyStore"/> puts in front of the ConfigDb key
///     lookup (R03:3.3). Bound from the same <c>Security:ApiKeys</c> section as <c>ApiKeyOptions</c> but
///     owned by the Host, where the store lives.
/// </summary>
/// <remarks>
///     <para>
///         <b>Why.</b> The negative cache was keyed by key id, so a flood of DISTINCT well-formed
///         <c>otua_&lt;random&gt;_x</c> credentials missed it every time and cost one indexed SQL query per
///         attempt — under the SDK's SessionManager-wide lock — with no credential needed. Two guards close
///         that: a <b>known-id set</b> (every <c>ApiKeyId</c> the ConfigDb holds, refreshed every
///         <c>StoreCacheSeconds</c>) rejects an unknown id in memory, and a <b>miss budget</b> (token
///         bucket) bounds how many lookups that reach the store and MISS are allowed per second when the
///         set is unavailable.
///     </para>
///     <para>
///         The budget is process-wide, not per remote endpoint: the OPC UA SDK's impersonation callback
///         (the <c>IOpcUaUserAuthenticator</c> seam) does not carry the client's address. Per-endpoint
///         accounting needs that seam widened in the OpcUaServer project — a follow-up, not this lane.
///     </para>
/// </remarks>
public sealed class ApiKeyStoreGuardOptions
{
    /// <summary>The configuration section the knobs live in (shared with <c>ApiKeyOptions</c>).</summary>
    public const string SectionName = "Security:ApiKeys";

    /// <summary>
    ///     Whether the known-id set is consulted. <see langword="false"/> restores a store read per unknown
    ///     id. Only meaningful when the inner store can list ids (the ConfigDb store can; the artifact
    ///     store is never wrapped).
    /// </summary>
    public bool KnownIdSet { get; set; } = true;

    /// <summary>
    ///     How many store MISSES (lookups that reach the inner store and find no key) may burst before
    ///     further lookups for unknown ids are refused without a store read. <c>0</c> disables the budget.
    /// </summary>
    public int MissBurst { get; set; } = 100;

    /// <summary>How many miss tokens are restored per second, up to <see cref="MissBurst"/>.</summary>
    public double MissRefillPerSecond { get; set; } = 20;

    /// <summary>Binds the section, with defaults for anything absent.</summary>
    /// <param name="configuration">The app configuration; null yields the defaults.</param>
    /// <returns>The bound options.</returns>
    public static ApiKeyStoreGuardOptions Bind(IConfiguration? configuration)
    {
        var options = new ApiKeyStoreGuardOptions();
        configuration?.GetSection(SectionName).Bind(options);
        return options;
    }
}