using EnvelopeGenerator.Application.Common.Enums;
using System.ComponentModel.DataAnnotations;

namespace EnvelopeGenerator.Application.Common.Configurations;

/// <summary>
/// Represents PKCS#11 signing configuration for PDF signing workflows.
/// This options model maps to the <c>Crypt:Pkcs11</c> configuration section.
/// </summary>
public sealed class Pkcs11Options
{
    /// <summary>
    /// Configuration section path used for binding PKCS#11 options.
    /// </summary>
    public const string SectionName = "Crypt:Pkcs11";

    /// <summary>
    /// Absolute or resolvable file path of the PKCS#11 provider library.
    /// </summary>
    [Required]
    [MinLength(1)]
    public required string LibraryPath { get; set; }

    /// <summary>
    /// Optional numeric slot identifier used to directly select the target token slot.
    /// </summary>
    public ulong? SlotId { get; set; }

    /// <summary>
    /// Optional token label used as a fallback token selector when <see cref="SlotId"/> is not provided.
    /// </summary>
    public string? TokenLabel { get; set; }

    /// <summary>
    /// Optional PKCS#11 proxy endpoint (for example <c>tcp://host:port</c>).
    /// </summary>
    public string? ProxySocket { get; set; }

    /// <summary>
    /// Optional full path to <c>pkcs11-tool</c>, used by diagnostics and fallback paths.
    /// </summary>
    public string? ToolPath { get; set; }

    /// <summary>
    /// User PIN used to authenticate to the PKCS#11 token session.
    /// </summary>
    [Required]
    [MinLength(1)]
    public required string UserPin { get; set; }

    /// <summary>
    /// Label of the private key object used to create digital signatures.
    /// </summary>
    [Required]
    [MinLength(1)]
    public required string PrivateKeyLabel { get; set; }

    /// <summary>
    /// Label of the certificate object returned/embedded with the signature.
    /// </summary>
    [Required]
    [MinLength(1)]
    public required string CertificateLabel { get; set; }

    /// <summary>
    /// Optional global default signing reason used when request-level options do not specify a value.
    /// </summary>
    public string? DefaultReason { get; set; }

    /// <summary>
    /// Optional global default application name used when request-level options do not specify a value.
    /// </summary>
    public string? DefaultApplicationName { get; set; }

    /// <summary>
    /// Controls how fallback signing time is created when request-level options do not specify a value.
    /// <c>true</c> uses <see cref="DateTimeOffset.UtcNow"/>, <c>false</c> uses <see cref="DateTimeOffset.Now"/>.
    /// </summary>
    public bool UseUtcSigningTime { get; set; } = true;

    /// <summary>
    /// Optional global default certification level used when request-level options do not specify a value.
    /// </summary>
    public PdfSignatureCertificationLevel? DefaultCertificationLevel { get; set; }
}