package config

import (
	"fmt"
	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
	"net/netip"
	"strconv"
	"strings"
	"time"
)

func loginPolicyFromEnv(get func(string) string) (consoleauth.LoginPolicy, error) {
	p := consoleauth.DefaultLoginPolicy()
	for _, f := range []struct {
		name string
		dst  *int
	}{
		{"ORBIT_CONSOLE_LOGIN_FAILURE_LIMIT", &p.FailureLimit},
		{"ORBIT_CONSOLE_LOGIN_ACCOUNT_LIMIT", &p.AccountLimit},
		{"ORBIT_CONSOLE_LOGIN_IP_LIMIT", &p.IPLimit},
		{"ORBIT_CONSOLE_LOGIN_AUDIT_DAYS", &p.AuditDays},
	} {
		if raw := get(f.name); raw != "" {
			n, err := strconv.Atoi(raw)
			if err != nil {
				return p, fmt.Errorf("invalid %s", f.name)
			}
			*f.dst = n
		}
	}
	for _, f := range []struct {
		name string
		dst  *time.Duration
	}{
		{"ORBIT_CONSOLE_LOGIN_FAILURE_WINDOW", &p.FailureWindow},
		{"ORBIT_CONSOLE_LOGIN_LOCK_DURATION", &p.LockDuration},
		{"ORBIT_CONSOLE_LOGIN_RATE_WINDOW", &p.RateWindow},
	} {
		if raw := get(f.name); raw != "" {
			d, err := time.ParseDuration(raw)
			if err != nil {
				return p, fmt.Errorf("invalid %s", f.name)
			}
			*f.dst = d
		}
	}
	if raw := get("ORBIT_CONSOLE_TRUSTED_PROXIES"); raw != "" {
		for _, item := range strings.Split(raw, ",") {
			prefix, err := netip.ParsePrefix(strings.TrimSpace(item))
			if err != nil {
				return p, fmt.Errorf("invalid ORBIT_CONSOLE_TRUSTED_PROXIES CIDR")
			}
			p.TrustedProxies = append(p.TrustedProxies, prefix.Masked())
		}
	}
	return p, p.Validate()
}