use serde::{Deserialize, Serialize};

use crate::secret::SecretMaterial;

pub const DEFAULT_LISTEN_ADDRESS: &str = "127.0.0.1:7032";
pub const DEFAULT_NONCE_TTL_SECS: u64 = 120;
pub const DEFAULT_CLOCK_SKEW_SECS: u64 = 30;

/// 内部 RPC 协议参数。身份信封由平台公钥加密、HMAC 签名，event 用私钥解密并验签。
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(default)]
pub struct RpcConfig {
    pub listen_address: String,
    /// 入站门禁：`x-rpc-key`。至少 32 字符。
    pub rpc_key: String,
    pub identity_key_id: String,
    #[serde(default)]
    pub identity_private_key: SecretMaterial,
    pub platform_mac_key_id: String,
    #[serde(default)]
    pub platform_mac_key: SecretMaterial,
    pub nonce_ttl_secs: u64,
    pub clock_skew_secs: u64,
    /// 出站调用平台时使用的请求超时。
    pub call_timeout_secs: u64,
}

impl RpcConfig {
    pub fn validate(&self) -> Result<(), String> {
        if self.listen_address.trim().is_empty() {
            return Err("event.rpc.listen_address must not be blank".to_string());
        }
        if !self.rpc_key.is_empty() && self.rpc_key.len() < 32 {
            return Err("event.rpc.rpc_key must be at least 32 characters".to_string());
        }
        if self.nonce_ttl_secs == 0 {
            return Err("event.rpc.nonce_ttl_secs must be greater than zero".to_string());
        }
        if self.clock_skew_secs == 0 {
            return Err("event.rpc.clock_skew_secs must be greater than zero".to_string());
        }
        if self.call_timeout_secs == 0 {
            return Err("event.rpc.call_timeout_secs must be greater than zero".to_string());
        }
        Ok(())
    }
}

impl Default for RpcConfig {
    fn default() -> Self {
        Self {
            listen_address: DEFAULT_LISTEN_ADDRESS.to_string(),
            rpc_key: String::new(),
            identity_key_id: String::new(),
            identity_private_key: SecretMaterial::default(),
            platform_mac_key_id: String::new(),
            platform_mac_key: SecretMaterial::default(),
            nonce_ttl_secs: DEFAULT_NONCE_TTL_SECS,
            clock_skew_secs: DEFAULT_CLOCK_SKEW_SECS,
            call_timeout_secs: 5,
        }
    }
}