using StellaOps.Cryptography;

namespace StellaOps.Configuration;

public sealed class AuthoritySecurityOptions
{
    /// <summary>
    /// Rate limiting configuration applied to Authority endpoints.
    /// </summary>
    public AuthorityRateLimitingOptions RateLimiting { get; } = new();

    /// <summary>
    /// Default password hashing parameters advertised to Authority plug-ins.
    /// </summary>
    public PasswordHashOptions PasswordHashing { get; } = new();

    /// <summary>
    /// Sender-constraint configuration (DPoP, mTLS).
    /// </summary>
    public AuthoritySenderConstraintOptions SenderConstraints { get; } = new();

    internal void Validate()
    {
        RateLimiting.Validate();
        PasswordHashing.Validate();
        SenderConstraints.Validate();
    }
}