using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.DependencyInjection.Extensions;
using Microsoft.Extensions.Options;
using ZB.MOM.WW.Auth.Abstractions.Ldap;
using ZB.MOM.WW.Auth.Ldap;

namespace ZB.MOM.WW.Auth.AspNetCore;

/// <summary>
/// Dependency-injection helpers that wire up the ZB.MOM.WW LDAP authentication provider
/// from configuration. Composes the concrete implementation living in the
/// <c>ZB.MOM.WW.Auth.Ldap</c> package so consuming apps register a provider with a single call.
/// </summary>
/// <remarks>
/// API-key DI wiring lives in <c>ZB.MOM.WW.Auth.ApiKeys</c>
/// (<c>ZB.MOM.WW.Auth.ApiKeys.DependencyInjection.ApiKeyServiceCollectionExtensions.AddZbApiKeyAuth</c>)
/// so that an LDAP-only consumer can reference this package without pulling in SQLite.
/// </remarks>
public static class ServiceCollectionExtensions
{
    /// <summary>
    /// Registers LDAP authentication: binds and validates <see cref="LdapOptions"/> from the
    /// configuration section at <paramref name="sectionPath"/>, and registers
    /// <see cref="ILdapAuthService"/>.
    /// </summary>
    /// <param name="services">The service collection to add to.</param>
    /// <param name="config">The application configuration.</param>
    /// <param name="sectionPath">Path of the configuration section holding the LDAP options.</param>
    /// <returns>The same <paramref name="services"/> instance, for chaining.</returns>
    public static IServiceCollection AddZbLdapAuth(
        this IServiceCollection services,
        IConfiguration config,
        string sectionPath)
    {
        ArgumentNullException.ThrowIfNull(services);
        ArgumentNullException.ThrowIfNull(config);
        ArgumentException.ThrowIfNullOrWhiteSpace(sectionPath);

        // Bind via the options builder and opt into start-time validation. An IValidateOptions<T>
        // otherwise only runs when the options are first materialized (IOptions<T>.Value) — which
        // here is the first login (ILdapAuthService factory below), not boot. ValidateOnStart hooks
        // the host's start-time options validation so a misconfigured directory (e.g. insecure
        // transport without AllowInsecure) fails fast at startup rather than on first login.
        services.AddOptions<LdapOptions>()
            .Bind(config.GetSection(sectionPath))
            .ValidateOnStart();

        // Fail fast at startup on a misconfigured directory rather than on first login.
        services.AddSingleton<IValidateOptions<LdapOptions>, LdapOptionsValidator>();

        // LdapAuthService opens/disposes a connection per call and is not IDisposable. Its only
        // mutable state is the sticky endpoint preference used by FallbackServers failover —
        // which is precisely why the instance must be shared, so a primary-DC outage is paid
        // for once rather than on every login. Singleton is correct; TryAdd mirrors the pattern
        // in AddZbApiKeyAuth (idempotency). The logger is resolved with GetService, not
        // GetRequiredService, so a host without logging configured still resolves the service.
        services.TryAddSingleton<ILdapAuthService>(sp =>
            new LdapAuthService(
                sp.GetRequiredService<IOptions<LdapOptions>>().Value,
                sp.GetService<Microsoft.Extensions.Logging.ILogger<LdapAuthService>>()));

        return services;
    }
}