package httpsecurity

import (
	"fmt"
	"time"

	"github.com/proxy-pool/proxy-pool/internal/config"
	platformAdmission "github.com/proxy-pool/proxy-pool/internal/platform/admission"
)

func BuildFromListener(listener config.Listener, clientIdentification string, semantics Semantics) (*Protection, error) {
	var admitter Admitter
	if listener.Limits.RequestsPerMinute > 0 || listener.Limits.RequestsPerMinutePerClient > 0 {
		limiter, err := platformAdmission.NewFixedWindow(platformAdmission.FixedWindowConfig{
			Window: time.Minute,
			Global: listener.Limits.RequestsPerMinute,
			PerKey: listener.Limits.RequestsPerMinutePerClient,
		})
		if err != nil {
			return nil, fmt.Errorf("build HTTP security admission: %w", err)
		}
		admitter = limiter
	}
	return NewFromListener(listener, clientIdentification, semantics, admitter)
}

func NewFromListener(listener config.Listener, clientIdentification string, semantics Semantics, admitter Admitter) (*Protection, error) {
	methods := make([]Method, 0, len(listener.Auth.Methods))
	for _, method := range listener.Auth.Methods {
		methods = append(methods, Method{
			Mode:     method.Mode,
			Username: method.Username,
			Password: method.Password,
			Header:   method.Header,
			Value:    method.Value,
			CIDRs:    append([]string(nil), method.CIDRs...),
		})
	}
	return New(Config{
		TrustedProxies: append([]string(nil), listener.Access.TrustedProxies...),
		AllowCIDRs:     append([]string(nil), listener.Access.AllowCIDRs...),
		Authentication: Authentication{
			Mode:     listener.Auth.Mode,
			Username: listener.Auth.Username,
			Password: listener.Auth.Password,
			Header:   listener.Auth.Header,
			Token:    listener.Auth.Token,
			CIDRs:    append([]string(nil), listener.Auth.CIDRs...),
			Methods:  methods,
		},
		ClientIdentification: clientIdentification,
		Semantics:            semantics,
	}, admitter)
}