namespace ZB.MOM.WW.MxGateway.Server.Configuration;

public sealed class AuthenticationOptions
{
    /// <summary>Gets the authentication mode.</summary>
    public AuthenticationMode Mode { get; init; } = AuthenticationMode.ApiKey;

    /// <summary>
    /// Gets the SQLite database path for authentication credentials. The default is
    /// derived from <see cref="Environment.SpecialFolder.CommonApplicationData"/>
    /// (<c>C:\ProgramData</c> on Windows, <c>/usr/share</c> or the container equivalent
    /// elsewhere) so the credential store never lands in the launch working directory on a
    /// non-Windows host. The production hosts override this with an explicit path in
    /// <c>appsettings.json</c>; the validator rejects a non-rooted override.
    /// </summary>
    public string SqlitePath { get; init; } = Path.Combine(
        Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData),
        "MxGateway",
        "gateway-auth.db");

    /// <summary>Gets the secret manager name for API key pepper.</summary>
    public string PepperSecretName { get; init; } = "MxGateway:ApiKeyPepper";

    /// <summary>Gets whether database migrations should run on startup.</summary>
    public bool RunMigrationsOnStartup { get; init; } = true;
}