namespace GB5Shared.Vault
{
    /// <summary>
    /// Vault authentication methods supported by <see cref="VaultServiceExtensions.AddGB5Vault"/>.
    /// Only <see cref="Token"/> is implemented today; the others are modeled for future providers
    /// registered via <see cref="Auth.IVaultAuthMethodProvider"/>.
    /// </summary>
    public enum VaultAuthMethod
    {
        Token,
        AppRole,
        Kubernetes
    }

    /// <summary>
    /// Strongly typed configuration for the GB5 Vault integration.
    /// Bound from the <c>"Vault"</c> configuration section. All values should come from
    /// <c>appsettings.json</c> or environment variables (e.g. <c>Vault__Address</c>,
    /// <c>Vault__Token</c>) — never hardcode Vault addresses or tokens in source.
    /// </summary>
    public class VaultOptions
    {
        public const string SectionName = "Vault";

        /// <summary>Base URL of the Vault server, e.g. "http://127.0.0.1:8200".</summary>
        public string Address { get; set; } = string.Empty;

        /// <summary>KV v2 secrets engine mount point.</summary>
        public string MountPoint { get; set; } = "secret";

        /// <summary>Vault Enterprise namespace, if applicable.</summary>
        public string? Namespace { get; set; }

        public VaultAuthMethod AuthMethod { get; set; } = VaultAuthMethod.Token;

        /// <summary>Required when <see cref="AuthMethod"/> is <see cref="VaultAuthMethod.Token"/>.</summary>
        public string? Token { get; set; }

        /// <summary>Reserved for the future AppRole auth provider.</summary>
        public string? RoleId { get; set; }

        /// <summary>Reserved for the future AppRole auth provider.</summary>
        public string? SecretId { get; set; }

        /// <summary>Reserved for the future Kubernetes auth provider.</summary>
        public string? KubernetesRole { get; set; }

        /// <summary>Reserved for the future Kubernetes auth provider.</summary>
        public string KubernetesJwtPath { get; set; } = "/var/run/secrets/kubernetes.io/serviceaccount/token";

        /// <summary>Timeout for Vault API calls.</summary>
        public int RequestTimeoutSeconds { get; set; } = 10;

        /// <summary>Maximum retry attempts for transient Vault failures.</summary>
        public int RetryMaxAttempts { get; set; } = 3;

        /// <summary>Base delay for exponential backoff between retries.</summary>
        public int RetryBaseDelayMilliseconds { get; set; } = 250;

        /// <summary>Sliding TTL for the in-process secret cache.</summary>
        public int CacheTtlSeconds { get; set; } = 300;
    }
}