namespace StellaOps.Cryptography.Kms;

/// <summary>
/// Configuration for FIDO2-backed signing flows.
/// </summary>
public sealed class Fido2Options
{
    private TimeSpan _metadataCacheDuration = TimeSpan.FromMinutes(5);

    /// <summary>
    /// Gets or sets the relying party identifier (rpId) used when registering the credential.
    /// </summary>
    public string RelyingPartyId { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets the credential identifier (Base64Url encoded string).
    /// </summary>
    public string CredentialId { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets the PEM-encoded public key associated with the credential.
    /// </summary>
    public string PublicKeyPem { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets the timestamp when the credential was provisioned.
    /// When not set, the Fido2KmsClient will use the current time via TimeProvider.
    /// </summary>
    public DateTimeOffset? CreatedAt { get; set; }

    /// <summary>
    /// Gets or sets the cache duration for metadata lookups.
    /// </summary>
    public TimeSpan MetadataCacheDuration
    {
        get => _metadataCacheDuration;
        set => _metadataCacheDuration = value <= TimeSpan.Zero ? TimeSpan.FromMinutes(5) : value;
    }
}