namespace ZB.MOM.WW.MxGateway.Server.Dashboard;

public static class DashboardAuthenticationDefaults
{
    /// <summary>Cookie scheme used to authenticate interactive dashboard requests.</summary>
    public const string AuthenticationScheme = "MxGateway.Dashboard";

    /// <summary>
    /// Bearer scheme used to authenticate SignalR hub connections. Hubs cannot
    /// reuse the browser's HttpOnly cookie when the client SignalR JS resolves
    /// the cookie scope to loopback, so the dashboard mints a short-lived
    /// data-protected bearer token on demand.
    /// </summary>
    public const string HubAuthenticationScheme = "MxGateway.Dashboard.HubToken";

    /// <summary>
    /// Policy guarding read-only dashboard pages. Allowed roles:
    /// <see cref="DashboardRoles.Admin"/> or <see cref="DashboardRoles.Viewer"/>.
    /// </summary>
    public const string ViewerPolicy = "MxGateway.Dashboard.Viewer";

    /// <summary>
    /// Policy guarding write-capable dashboard pages and admin endpoints
    /// (API-key CRUD, settings edits, hub publishes). Allowed role:
    /// <see cref="DashboardRoles.Admin"/>.
    /// </summary>
    public const string AdminPolicy = "MxGateway.Dashboard.Admin";

    /// <summary>
    /// Policy attached to SignalR hubs — accepts either the cookie scheme
    /// (in-page connect) or the hub-token bearer scheme (cross-origin or
    /// WebSocket connect where the cookie can't be forwarded).
    /// </summary>
    public const string HubClientsPolicy = "MxGateway.Dashboard.HubClients";

    public const string LdapGroupClaimType = "mxgateway:ldap_group";
    public const string KeyPrefixClaimType = "mxgateway:key_prefix";

    /// <summary>
    /// Claim carrying one dashboard event-visibility tag the caller is granted (SEC-25). Stamped
    /// at cookie login by <see cref="DashboardAuthenticator"/> and at hub-token mint by
    /// <see cref="HubTokenService"/>, both resolving the caller's LDAP groups through
    /// <c>MxGateway:Dashboard:GroupToTag</c>; read by <see cref="IDashboardSessionAcl"/>. A
    /// principal carrying none of these claims is an empty-grant Viewer, which is the fail-closed
    /// default. Visibility only — it never grants data access.
    /// </summary>
    public const string DashboardTagClaimType = "zb:dashboardtag";

    /// <summary>
    /// Dashboard auth cookie name used when the cookie is not guaranteed to be Secure
    /// (<c>RequireHttpsCookie=false</c> → <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.SameAsRequest"/>)
    /// or when an explicit <c>MxGateway:Dashboard:CookieName</c> override is absent but the
    /// secure default cannot be applied. This plain name carries no browser-enforced guarantees.
    /// </summary>
    public const string CookieName = "MxGatewayDashboard";

    /// <summary>
    /// Dashboard auth cookie name applied when the cookie is guaranteed Secure
    /// (<c>RequireHttpsCookie=true</c> → <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.Always"/>)
    /// and no explicit <c>MxGateway:Dashboard:CookieName</c> override is set. The <c>__Host-</c>
    /// prefix instructs browsers to enforce Secure, no <c>Domain</c>, and <c>Path=/</c>; those
    /// guarantees only hold for a Secure cookie, so this name must never be applied unless
    /// <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.Always"/> is in
    /// effect — a <c>__Host-</c> cookie without Secure is silently dropped by browsers.
    /// </summary>
    public const string SecureCookieName = "__Host-MxGatewayDashboard";
}