namespace StellaOps.Cryptography.Kms;

/// <summary>
/// Configuration for PKCS#11-based HSM integrations.
/// </summary>
public sealed class Pkcs11Options
{
    private TimeSpan _metadataCacheDuration = TimeSpan.FromMinutes(5);
    private TimeSpan _publicKeyCacheDuration = TimeSpan.FromMinutes(5);

    /// <summary>
    /// Gets or sets the native PKCS#11 library path.
    /// </summary>
    public string LibraryPath { get; set; } = string.Empty;

    /// <summary>
    /// Gets or sets an optional slot identifier (decimal or hexadecimal). Mutually exclusive with <see cref="TokenLabel"/>.
    /// </summary>
    public string? SlotId { get; set; }

    /// <summary>
    /// Gets or sets an optional token label to select the target slot. Mutually exclusive with <see cref="SlotId"/>.
    /// </summary>
    public string? TokenLabel { get; set; }

    /// <summary>
    /// Gets or sets the PKCS#11 private key label.
    /// </summary>
    public string? PrivateKeyLabel { get; set; }

    /// <summary>
    /// Gets or sets the PKCS#11 public key label (optional; falls back to <see cref="PrivateKeyLabel"/>).
    /// </summary>
    public string? PublicKeyLabel { get; set; }

    /// <summary>
    /// Gets or sets the PIN used for user authentication.
    /// </summary>
    public string? UserPin { get; set; }

    /// <summary>
    /// Gets or sets an optional PKCS#11 mechanism identifier (default: CKM_ECDSA).
    /// </summary>
    public uint MechanismId { get; set; } = (uint)Net.Pkcs11Interop.Common.CKM.CKM_ECDSA;

    /// <summary>
    /// Gets or sets the cache duration for metadata requests (slot/key info).
    /// </summary>
    public TimeSpan MetadataCacheDuration
    {
        get => _metadataCacheDuration;
        set => _metadataCacheDuration = EnsurePositive(value, TimeSpan.FromMinutes(5));
    }

    /// <summary>
    /// Gets or sets the cache duration for public key material.
    /// </summary>
    public TimeSpan PublicKeyCacheDuration
    {
        get => _publicKeyCacheDuration;
        set => _publicKeyCacheDuration = EnsurePositive(value, TimeSpan.FromMinutes(5));
    }

    private static TimeSpan EnsurePositive(TimeSpan value, TimeSpan fallback)
        => value <= TimeSpan.Zero ? fallback : value;
}