using System;

namespace ZB.MOM.WW.MxGateway.Worker.Ipc;

/// <summary>Configuration options for worker pipe sessions including heartbeat parameters.</summary>
public sealed class WorkerPipeSessionOptions
{
    /// <summary>Default heartbeat interval (5 seconds).</summary>
    public static readonly TimeSpan DefaultHeartbeatInterval = TimeSpan.FromSeconds(5);
    /// <summary>Default heartbeat grace period (15 seconds).</summary>
    public static readonly TimeSpan DefaultHeartbeatGrace = TimeSpan.FromSeconds(15);
    /// <summary>
    ///     Default defensive ceiling beyond which the watchdog fires
    ///     <see cref="ZB.MOM.WW.MxGateway.Contracts.Proto.WorkerFaultCategory.StaHung"/>
    ///     even while a command is in flight (75 seconds = 5 ×
    ///     <see cref="DefaultHeartbeatGrace"/>). See <see cref="HeartbeatStuckCeiling"/>
    ///     for the rationale.
    /// </summary>
    public static readonly TimeSpan DefaultHeartbeatStuckCeiling = TimeSpan.FromSeconds(75);

    /// <summary>Initializes a new instance of the WorkerPipeSessionOptions class with default values.</summary>
    public WorkerPipeSessionOptions()
    {
        HeartbeatInterval = DefaultHeartbeatInterval;
        HeartbeatGrace = DefaultHeartbeatGrace;
        HeartbeatStuckCeiling = DefaultHeartbeatStuckCeiling;
    }

    /// <summary>Gets or sets the heartbeat interval.</summary>
    public TimeSpan HeartbeatInterval { get; set; }

    /// <summary>Gets or sets the heartbeat grace period.</summary>
    public TimeSpan HeartbeatGrace { get; set; }

    /// <summary>
    ///     Gets or sets the defensive upper bound on how long the watchdog
    ///     will suppress its <c>StaHung</c> fault while a command is in
    ///     flight. Worker-017 suppresses the watchdog when the heartbeat
    ///     snapshot's <c>CurrentCommandCorrelationId</c> is non-empty so a
    ///     legitimately slow command (e.g. <c>ReadBulk</c> against many
    ///     uncached tags) does not self-fault — but a truly stuck
    ///     synchronous COM call against a dead MXAccess provider leaves
    ///     <c>CurrentCommandCorrelationId</c> non-empty forever and would
    ///     permanently defeat the watchdog. <c>HeartbeatStuckCeiling</c> is
    ///     the upper bound on that suppression: once
    ///     <c>LastStaActivityUtc</c> has been stale for longer than this
    ///     ceiling, the watchdog DOES fire <c>StaHung</c> even with a
    ///     command in flight, on the assumption that no legitimate STA
    ///     command should run that long without periodically refreshing
    ///     activity. Default is <see cref="DefaultHeartbeatStuckCeiling"/>
    ///     (75 seconds = 5 × <see cref="DefaultHeartbeatGrace"/>); raise
    ///     for deployments that run very long bulk operations.
    /// </summary>
    public TimeSpan HeartbeatStuckCeiling { get; set; }

    /// <summary>Validates the session options.</summary>
    public void Validate()
    {
        if (HeartbeatInterval <= TimeSpan.Zero)
        {
            throw new ArgumentOutOfRangeException(
                nameof(HeartbeatInterval),
                "Worker heartbeat interval must be greater than zero.");
        }

        if (HeartbeatGrace <= TimeSpan.Zero)
        {
            throw new ArgumentOutOfRangeException(
                nameof(HeartbeatGrace),
                "Worker heartbeat grace must be greater than zero.");
        }

        if (HeartbeatStuckCeiling <= TimeSpan.Zero)
        {
            throw new ArgumentOutOfRangeException(
                nameof(HeartbeatStuckCeiling),
                "Worker heartbeat stuck ceiling must be greater than zero.");
        }

        if (HeartbeatStuckCeiling <= HeartbeatGrace)
        {
            throw new ArgumentOutOfRangeException(
                nameof(HeartbeatStuckCeiling),
                "Worker heartbeat stuck ceiling must be greater than HeartbeatGrace; "
                + "otherwise it would fire before the in-flight-command suppression had any effect.");
        }
    }
}