using EnvelopeGenerator.Application.Common.Enums;
using System.ComponentModel.DataAnnotations;

namespace EnvelopeGenerator.Application.Common.Configurations;

/// <summary>
/// Represents PKCS#11 signing configuration for PDF signing workflows.
/// This options model maps to the <c>Crypt:Pkcs11</c> configuration section.
/// </summary>
public sealed class Pkcs11Options
{
    /// <summary>
    /// Configuration section path used for binding PKCS#11 options.
    /// </summary>
    public const string SectionName = "Crypt:Pkcs11";

    /// <summary>
    /// Optional base directory that contains the <c>pkcs11</c> folder.
    /// If null/empty, runtime uses the application base directory.
    /// </summary>
    public string? AssetsRootPath { get; set; }

    /// <summary>
    /// Optional numeric slot identifier used to directly select the target token slot.
    /// </summary>
    public ulong? SlotId { get; set; }

    /// <summary>
    /// Optional token label used as a fallback token selector when <see cref="SlotId"/> is not provided.
    /// </summary>
    public string? TokenLabel { get; set; }

    /// <summary>
    /// Optional PKCS#11 proxy endpoint (for example <c>tcp://host:port</c>).
    /// </summary>
    public string? ProxySocket { get; set; }

    /// <summary>
    /// Resolved absolute PKCS#11 proxy module path used at runtime.
    /// Computed from <see cref="AssetsRootPath"/> and runtime defaults.
    /// </summary>
    public string ResolvedLibraryPath { get; private set; } = string.Empty;

    /// <summary>
    /// Resolved absolute pkcs11-tool path used at runtime.
    /// Computed from <see cref="AssetsRootPath"/> and runtime defaults.
    /// Can be null when tool fallback is not available.
    /// </summary>
    public string? ResolvedToolPath { get; private set; }

    public void SetResolvedPaths(string resolvedLibraryPath, string? resolvedToolPath)
    {
        ResolvedLibraryPath = resolvedLibraryPath;
        ResolvedToolPath = resolvedToolPath;
    }

    /// <summary>
    /// User PIN used to authenticate to the PKCS#11 token session.
    /// </summary>
    [Required]
    [MinLength(1)]
    public required string UserPin { get; set; }

    /// <summary>
    /// Label of the private key object used to create digital signatures.
    /// </summary>
    [Required]
    [MinLength(1)]
    public required string PrivateKeyLabel { get; set; }

    /// <summary>
    /// Label of the certificate object returned/embedded with the signature.
    /// </summary>
    [Required]
    [MinLength(1)]
    public required string CertificateLabel { get; set; }

    /// <summary>
    /// Optional global default signing reason used when request-level options do not specify a value.
    /// </summary>
    public string? DefaultReason { get; set; }

    /// <summary>
    /// Optional global default application name used when request-level options do not specify a value.
    /// </summary>
    public string? DefaultApplicationName { get; set; }

    /// <summary>
    /// Controls how fallback signing time is created when request-level options do not specify a value.
    /// <c>true</c> uses <see cref="DateTimeOffset.UtcNow"/>, <c>false</c> uses <see cref="DateTimeOffset.Now"/>.
    /// </summary>
    public bool UseUtcSigningTime { get; set; } = true;

    /// <summary>
    /// Optional global default certification level used when request-level options do not specify a value.
    /// </summary>
    public PdfSignatureCertificationLevel? DefaultCertificationLevel { get; set; }
}