// Package config defines the vault-tui configuration schema and how it is
// loaded from disk, merged with per-profile defaults, and combined with
// environment variables and CLI flags to produce a fully resolved
// [vault.Settings] (see internal/vault/settings.go and resolve.go in this
// package).
package config

import "time"

// SchemaVersion is the only value config.Version currently accepts.
const SchemaVersion = 1

// File is the root of ~/.config/vault-tui/config.yaml.
type File struct {
	Version        int                 `yaml:"version"`
	CurrentProfile string              `yaml:"current_profile,omitempty"`
	Defaults       Profile             `yaml:"defaults,omitempty"`
	Profiles       map[string]*Profile `yaml:"profiles,omitempty"`
	UI             UI                  `yaml:"ui,omitempty"`
	Keys           map[string][]string `yaml:"keys,omitempty"`
	Theme          Theme               `yaml:"theme,omitempty"`
}

// UI holds settings that are not connection-related.
type UI struct {
	Appearance         string         `yaml:"appearance,omitempty"` // auto | dark | light
	ConfirmDestructive *bool          `yaml:"confirm_destructive,omitempty"`
	TTLWarnBelow       *time.Duration `yaml:"ttl_warn_below,omitempty"`
	MaskValues         *bool          `yaml:"mask_values,omitempty"`
	ClipboardClear     *time.Duration `yaml:"clipboard_clear_after,omitempty"`
	CacheTTL           *time.Duration `yaml:"cache_ttl,omitempty"`
	RequireCAS         *bool          `yaml:"require_cas,omitempty"`
	ReadOnly           *bool          `yaml:"read_only,omitempty"`
	BrowserCommand     string         `yaml:"browser_command,omitempty"`
}

// Profile is one named Vault connection + auth configuration. The
// zero-valued Profile is a legal "say nothing" value; every optional scalar
// is a pointer so that "false" and "unset" are distinguishable (this is
// what makes the defaults/profile merge in resolve.go correct).
type Profile struct {
	Address    string     `yaml:"address,omitempty"`
	Namespace  string     `yaml:"namespace,omitempty"`
	Production *bool      `yaml:"production,omitempty"`
	ReadOnly   *bool      `yaml:"read_only,omitempty"`
	IgnoreEnv  *bool      `yaml:"ignore_env,omitempty"`
	TLS        TLS        `yaml:"tls,omitempty"`
	Client     ClientOpts `yaml:"client,omitempty"`
	Auth       Auth       `yaml:"auth,omitempty"`
	Token      TokenOpts  `yaml:"token,omitempty"`
	Favourites []string   `yaml:"favourites,omitempty"`
}

type TLS struct {
	CACert     string `yaml:"ca_cert,omitempty"`
	CAPath     string `yaml:"ca_path,omitempty"`
	ClientCert string `yaml:"client_cert,omitempty"`
	ClientKey  string `yaml:"client_key,omitempty"`
	ServerName string `yaml:"tls_server_name,omitempty"`
	SkipVerify *bool  `yaml:"skip_verify,omitempty"`
}

type ClientOpts struct {
	Timeout          *time.Duration    `yaml:"timeout,omitempty"`
	MaxRetries       *int              `yaml:"max_retries,omitempty"`
	MinRetryWait     *time.Duration    `yaml:"min_retry_wait,omitempty"`
	MaxRetryWait     *time.Duration    `yaml:"max_retry_wait,omitempty"`
	SRVLookup        *bool             `yaml:"srv_lookup,omitempty"`
	DisableRedirects *bool             `yaml:"disable_redirects,omitempty"`
	HTTPProxy        string            `yaml:"http_proxy,omitempty"`
	RateLimit        string            `yaml:"rate_limit,omitempty"`
	Headers          map[string]string `yaml:"headers,omitempty"`
}

// Auth configures which auth method a profile logs in with, plus prefilled
// parameters. Params values are looked up by internal/auth.Field.Name (or
// Field.ConfigKey when set) and never store secrets that have an
// EnvFallback equivalent (see internal/auth/method.go).
type Auth struct {
	Method string            `yaml:"method,omitempty"`
	Mount  string            `yaml:"mount,omitempty"`
	Params map[string]string `yaml:"params,omitempty"`
	OIDC   OIDCOpts          `yaml:"oidc,omitempty"`
}

type OIDCOpts struct {
	ListenAddress       string         `yaml:"listen_address,omitempty"`
	Port                *int           `yaml:"port,omitempty"`
	CallbackMethod      string         `yaml:"callback_method,omitempty"`
	CallbackHost        string         `yaml:"callback_host,omitempty"`
	CallbackPort        *int           `yaml:"callback_port,omitempty"`
	CallbackPath        string         `yaml:"callback_path,omitempty"`
	SkipBrowser         *bool          `yaml:"skip_browser,omitempty"`
	AbortOnBrowserError *bool          `yaml:"abort_on_browser_error,omitempty"`
	Timeout             *time.Duration `yaml:"timeout,omitempty"`
}

// TokenOpts controls how the resolved token is persisted between runs.
type TokenOpts struct {
	// Storage is "vault-cli" (default, shares ~/.vault-token / the
	// configured token helper with the real Vault CLI), "profile" (its own
	// file under the XDG state dir, keyed by profile name), or "none"
	// (never persisted).
	Storage           string         `yaml:"storage,omitempty"`
	File              string         `yaml:"file,omitempty"`
	Value             string         `yaml:"value,omitempty"` // discouraged; Load warns
	MirrorToVaultCLI  *bool          `yaml:"mirror_to_vault_cli,omitempty"`
	AutoRenew         *bool          `yaml:"auto_renew,omitempty"`
	RenewIncrement    *time.Duration `yaml:"renew_increment,omitempty"`
	RevokeOnLogout    *bool          `yaml:"revoke_on_logout,omitempty"`
	ValidateOnStartup *bool          `yaml:"validate_on_startup,omitempty"`
}

// Theme is the YAML-facing color/appearance schema; see internal/ui/theme
// for the Go types actually consumed by rendering.
type Theme struct {
	BorderStyle string           `yaml:"border_style,omitempty"`
	MaskChar    string           `yaml:"mask_char,omitempty"`
	Colors      map[string]Color `yaml:"colors,omitempty"`
}

// Color is either a single hex value (same in light and dark) or an
// adaptive pair. UnmarshalYAML (color.go) accepts both forms.
type Color struct {
	Light string
	Dark  string
}