<?php

declare(strict_types=1);

namespace App\Framework\Config;

/**
 * Security configuration that adapts to environment
 */
final readonly class SecurityConfig
{
    public function __construct(
        public string $appKey = '',
        public bool $enableSecurityHeaders = true,
        public bool $enableCsrfProtection = true,
        public bool $enableRateLimiting = true,
        public int $rateLimitPerMinute = 60,
        public int $rateLimitBurstSize = 10,
        public bool $logSecurityEvents = true,
        public bool $enableStrictMode = false,
        public array $allowedHosts = [],
        public int $sessionLifetime = 3600,
        public bool $secureSessionCookies = true,
        public bool $httpOnlySessionCookies = true
    ) {
    }

    public static function forEnvironment(EnvironmentType $environment, Environment $env): self
    {
        return match($environment) {
            EnvironmentType::PROD => self::production($env),
            EnvironmentType::STAGING => self::staging($env),
            EnvironmentType::DEV => self::development($env),
        };
    }

    private static function production(Environment $env): self
    {
        return new self(
            appKey: $env->getRequired(EnvKey::APP_KEY),
            enableSecurityHeaders: true,
            enableCsrfProtection: true,
            enableRateLimiting: true,
            rateLimitPerMinute: $env->getInt('SECURITY_RATE_LIMIT_PER_MINUTE', 30),
            rateLimitBurstSize: $env->getInt('SECURITY_RATE_LIMIT_BURST', 5),
            logSecurityEvents: true,
            enableStrictMode: true,
            allowedHosts: $env->getString('SECURITY_ALLOWED_HOSTS', '') ?
                explode(',', $env->getString('SECURITY_ALLOWED_HOSTS')) : [],
            sessionLifetime: $env->getInt('SESSION_LIFETIME', 1800), // 30 minutes
            secureSessionCookies: true,
            httpOnlySessionCookies: true
        );
    }

    private static function staging(Environment $env): self
    {
        return new self(
            appKey: $env->getRequired(EnvKey::APP_KEY),
            enableSecurityHeaders: true,
            enableCsrfProtection: true,
            enableRateLimiting: true,
            rateLimitPerMinute: $env->getInt('SECURITY_RATE_LIMIT_PER_MINUTE', 60),
            rateLimitBurstSize: $env->getInt('SECURITY_RATE_LIMIT_BURST', 10),
            logSecurityEvents: true,
            enableStrictMode: true,
            allowedHosts: $env->getString('SECURITY_ALLOWED_HOSTS', '') ?
                explode(',', $env->getString('SECURITY_ALLOWED_HOSTS')) : [],
            sessionLifetime: $env->getInt('SESSION_LIFETIME', 3600), // 1 hour
            secureSessionCookies: true,
            httpOnlySessionCookies: true
        );
    }

    private static function development(Environment $env): self
    {
        return new self(
            appKey: $env->getString(EnvKey::APP_KEY, 'dev-insecure-key-32-chars-long!!!'),
            enableSecurityHeaders: true, // Security Headers IMMER aktiv
            enableCsrfProtection: true, // CSRF IMMER aktiv für Sicherheit
            enableRateLimiting: $env->getBool('SECURITY_ENABLE_RATE_LIMITING', false),
            rateLimitPerMinute: $env->getInt('SECURITY_RATE_LIMIT_PER_MINUTE', 1000),
            rateLimitBurstSize: $env->getInt('SECURITY_RATE_LIMIT_BURST', 100),
            logSecurityEvents: $env->getBool('SECURITY_LOG_EVENTS', true),
            enableStrictMode: false,
            allowedHosts: [], // Allow all in development
            sessionLifetime: $env->getInt('SESSION_LIFETIME', 86400), // 24 hours
            secureSessionCookies: false, // Allow HTTP in development
            httpOnlySessionCookies: true
        );
    }
}
