package com.ttstd.signaling.security;

import org.springframework.boot.context.properties.ConfigurationProperties;

/**
 * 安全相关配置项，对应 application.yml 中的 {@code security.*}。
 */
@ConfigurationProperties(prefix = "security")
public class SecurityProperties {

    private final Jwt jwt = new Jwt();
    private final Device device = new Device();
    private final Account account = new Account();
    private final Admin admin = new Admin();
    private final WebSocket websocket = new WebSocket();
    private final Turn turn = new Turn();

    public Jwt getJwt() { return jwt; }
    public Device getDevice() { return device; }
    public Account getAccount() { return account; }
    public Admin getAdmin() { return admin; }
    public WebSocket getWebsocket() { return websocket; }
    public Turn getTurn() { return turn; }

    public static class Jwt {
        private String secret;
        private String issuer = "webrtc-signal-server";
        private long accessTokenTtlSeconds = 900;
        private long refreshTokenTtlSeconds = 604800;
        private long deviceTokenTtlSeconds = 900;
        private long clockSkewSeconds = 60;

        public String getSecret() { return secret; }
        public void setSecret(String secret) { this.secret = secret; }

        public String getIssuer() { return issuer; }
        public void setIssuer(String issuer) { this.issuer = issuer; }

        public long getAccessTokenTtlSeconds() { return accessTokenTtlSeconds; }
        public void setAccessTokenTtlSeconds(long v) { this.accessTokenTtlSeconds = v; }

        public long getRefreshTokenTtlSeconds() { return refreshTokenTtlSeconds; }
        public void setRefreshTokenTtlSeconds(long v) { this.refreshTokenTtlSeconds = v; }

        public long getDeviceTokenTtlSeconds() { return deviceTokenTtlSeconds; }
        public void setDeviceTokenTtlSeconds(long v) { this.deviceTokenTtlSeconds = v; }

        public long getClockSkewSeconds() { return clockSkewSeconds; }
        public void setClockSkewSeconds(long v) { this.clockSkewSeconds = v; }
    }

    public static class Device {
        private String provisionSecret;
        private long provisionSkewSeconds = 300;
        private boolean snAllowlistEnabled = false;

        public String getProvisionSecret() { return provisionSecret; }
        public void setProvisionSecret(String provisionSecret) { this.provisionSecret = provisionSecret; }

        public long getProvisionSkewSeconds() { return provisionSkewSeconds; }
        public void setProvisionSkewSeconds(long v) { this.provisionSkewSeconds = v; }

        public boolean isSnAllowlistEnabled() { return snAllowlistEnabled; }
        public void setSnAllowlistEnabled(boolean v) { this.snAllowlistEnabled = v; }
    }

    public static class Account {
        private boolean registrationEnabled = true;
        private int maxFailedAttempts = 5;
        private long lockDurationSeconds = 900;
        private int maxConcurrentSessions = 5;

        public boolean isRegistrationEnabled() { return registrationEnabled; }
        public void setRegistrationEnabled(boolean v) { this.registrationEnabled = v; }

        public int getMaxFailedAttempts() { return maxFailedAttempts; }
        public void setMaxFailedAttempts(int v) { this.maxFailedAttempts = v; }

        public long getLockDurationSeconds() { return lockDurationSeconds; }
        public void setLockDurationSeconds(long v) { this.lockDurationSeconds = v; }

        public int getMaxConcurrentSessions() { return maxConcurrentSessions; }
        public void setMaxConcurrentSessions(int v) { this.maxConcurrentSessions = v; }
    }

    /** 后台管理员专用配置（独立于普通用户体系）。 */
    public static class Admin {
        private String bootstrapUsername = "admin";
        private String bootstrapPassword;
        private long tokenTtlSeconds = 3600;

        public String getBootstrapUsername() { return bootstrapUsername; }
        public void setBootstrapUsername(String v) { this.bootstrapUsername = v; }

        public String getBootstrapPassword() { return bootstrapPassword; }
        public void setBootstrapPassword(String v) { this.bootstrapPassword = v; }

        public long getTokenTtlSeconds() { return tokenTtlSeconds; }
        public void setTokenTtlSeconds(long v) { this.tokenTtlSeconds = v; }
    }

    public static class WebSocket {
        private String allowedOrigins = "*";

        public String getAllowedOrigins() { return allowedOrigins; }
        public void setAllowedOrigins(String v) { this.allowedOrigins = v; }
    }

    public static class Turn {
        /** TURN 共享密钥（短期凭证的 HMAC key），生产环境务必通过环境变量注入 */
        private String sharedSecret;
        /** TURN 服务器地址列表，逗号分隔，如 turn:turn.ttstd.com:3478?transport=udp */
        private String urls = "";
        /** 短期凭证有效期（秒），到点后凭证失效，客户端需重新获取 */
        private long ttlSeconds = 3600;
        /** 是否启用 TURN 凭证发放 */
        private boolean enabled = false;

        public String getSharedSecret() { return sharedSecret; }
        public void setSharedSecret(String v) { this.sharedSecret = v; }
        public String getUrls() { return urls; }
        public void setUrls(String v) { this.urls = v; }
        public long getTtlSeconds() { return ttlSeconds; }
        public void setTtlSeconds(long v) { this.ttlSeconds = v; }
        public boolean isEnabled() { return enabled; }
        public void setEnabled(boolean v) { this.enabled = v; }
    }
}
