use serde::{Deserialize, Serialize};

use crate::secret::SecretMaterial;

#[derive(Debug, Clone, Default, Serialize, Deserialize)]
#[serde(default)]
pub struct InternalConfig {
    pub service_key: String,
    pub rpc: InternalRpcConfig,
    pub event_client: EventClientConfig,
}

impl InternalConfig {
    pub fn is_valid(&self) -> Result<(), String> {
        if !self.service_key.is_empty() && self.service_key.len() < 32 {
            return Err("internal.service_key must be at least 32 characters".to_string());
        }
        self.rpc.validate()?;
        self.event_client.validate()?;
        Ok(())
    }
}

/// serve 进程暴露的内部 RPC 服务端参数。
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
#[serde(default)]
pub struct InternalRpcConfig {
    pub listen_address: String,
    pub rpc_key: String,
}

impl InternalRpcConfig {
    pub fn validate(&self) -> Result<(), String> {
        if self.listen_address.trim().is_empty() {
            return Ok(());
        }
        if !self.rpc_key.is_empty() && self.rpc_key.len() < 32 {
            return Err("internal.rpc.rpc_key must be at least 32 characters".to_string());
        }
        Ok(())
    }
}

/// serve 进程访问 event 内部 RPC 的客户端参数（含身份信封公钥与 HMAC 密钥）。
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
#[serde(default)]
pub struct EventClientConfig {
    pub endpoint: String,
    pub rpc_key: String,
    pub timeout_secs: u64,
    pub key_id: String,
    #[serde(default)]
    pub public_key: SecretMaterial,
    pub mac_key_id: String,
    #[serde(default)]
    pub mac_key: SecretMaterial,
    pub clock_skew_secs: u64,
    pub envelope_ttl_secs: u64,
}

impl EventClientConfig {
    pub fn validate(&self) -> Result<(), String> {
        if self.endpoint.trim().is_empty() {
            return Ok(());
        }
        if !(self.endpoint.starts_with("http://") || self.endpoint.starts_with("https://")) {
            return Err("internal.event_client.endpoint must be an http(s) URL".to_string());
        }
        if !self.rpc_key.is_empty() && self.rpc_key.len() < 32 {
            return Err("internal.event_client.rpc_key must be at least 32 characters".to_string());
        }
        Ok(())
    }
}