using System.Text.Json;
using System.Text.Json.Serialization;

namespace MeterVault.Infrastructure.Ingestion;

/// <summary>
/// The parsed <see cref="Core.Domain.IngestionEndpoint.Config"/> JSON for an MQTT broker. Credentials
/// are never held here as plaintext (SDD §6.4): <see cref="UsernameEnv"/>/<see cref="PasswordEnv"/>
/// name environment variables resolved at runtime, or <see cref="UsernameEnc"/>/<see cref="PasswordEnc"/>
/// hold them encrypted under the app's data-protection key ring.
/// </summary>
public sealed record EndpointConfig
{
    private static readonly JsonSerializerOptions Options = new()
    {
        PropertyNameCaseInsensitive = true,
        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
    };

    public string Host { get; init; } = "localhost";

    public int Port { get; init; } = 1883;

    public bool Tls { get; init; }

    /// <summary>Extra topic filters to subscribe (beyond the sources' own topics), e.g. <c>tele/+/SENSOR</c>.</summary>
    public IReadOnlyList<string> ExtraTopics { get; init; } = [];

    public string? UsernameEnv { get; init; }

    public string? PasswordEnv { get; init; }

    /// <summary>
    /// Username entered directly in the admin UI. Held as-is: §6.4 covers tokens and passwords, and
    /// encrypting a username would only blank the field on every edit for no security gain.
    /// </summary>
    public string? Username { get; init; }

    /// <summary>Password encrypted by <see cref="Security.SecretProtector"/> (entered in the admin UI).</summary>
    public string? PasswordEnc { get; init; }

    public static EndpointConfig Parse(string? json)
    {
        if (string.IsNullOrWhiteSpace(json))
        {
            return new EndpointConfig();
        }

        try
        {
            return JsonSerializer.Deserialize<EndpointConfig>(json, Options) ?? new EndpointConfig();
        }
        catch (JsonException)
        {
            return new EndpointConfig();
        }
    }

    public string ToJson() => JsonSerializer.Serialize(this, Options);

    public string? ResolveUsername(Security.SecretProtector? protector = null) =>
        !string.IsNullOrWhiteSpace(Username)
            ? Username
            : EndpointSecret.Resolve(null, UsernameEnv, protector);

    public string? ResolvePassword(Security.SecretProtector? protector = null) =>
        EndpointSecret.Resolve(PasswordEnc, PasswordEnv, protector);
}