namespace StellaOps.Cryptography;

/// <summary>
/// Configuration options for cryptographic compliance.
/// </summary>
public sealed class CryptoComplianceOptions
{
    /// <summary>
    /// The configuration section key for binding.
    /// </summary>
    public const string SectionKey = "Crypto:Compliance";

    /// <summary>
    /// Active compliance profile ID.
    /// Valid values: "world", "fips", "gost", "sm", "kcmvp", "eidas".
    /// Default: "world".
    /// Can be overridden by STELLAOPS_CRYPTO_COMPLIANCE_PROFILE environment variable.
    /// </summary>
    public string ProfileId { get; set; } = "world";

    /// <summary>
    /// When true, fail on non-compliant algorithm usage.
    /// Default: true.
    /// Can be overridden by STELLAOPS_CRYPTO_STRICT_VALIDATION environment variable.
    /// </summary>
    public bool StrictValidation { get; set; } = true;

    /// <summary>
    /// When StrictValidation=false, emit warning instead of silently proceeding.
    /// Default: true.
    /// </summary>
    public bool WarnOnNonCompliant { get; set; } = true;

    /// <summary>
    /// Allow Interop purpose to override profile algorithm with SHA-256.
    /// Default: true.
    /// </summary>
    public bool AllowInteropOverride { get; set; } = true;

    /// <summary>
    /// Enable telemetry for all crypto operations.
    /// Default: true.
    /// </summary>
    public bool EnableTelemetry { get; set; } = true;

    /// <summary>
    /// Custom purpose-to-algorithm overrides that take precedence over profile defaults.
    /// Keys are from <see cref="HashPurpose"/>, values are from <see cref="HashAlgorithms"/>.
    /// </summary>
    public Dictionary<string, string>? PurposeOverrides { get; set; }

    /// <summary>
    /// Applies environment variable overrides.
    /// </summary>
    public void ApplyEnvironmentOverrides()
    {
        var profileEnv = Environment.GetEnvironmentVariable("STELLAOPS_CRYPTO_COMPLIANCE_PROFILE");
        if (!string.IsNullOrWhiteSpace(profileEnv))
        {
            ProfileId = profileEnv.Trim().ToLowerInvariant();
        }

        var strictEnv = Environment.GetEnvironmentVariable("STELLAOPS_CRYPTO_STRICT_VALIDATION");
        if (!string.IsNullOrWhiteSpace(strictEnv) &&
            bool.TryParse(strictEnv, out var strict))
        {
            StrictValidation = strict;
        }
    }
}