<?php

declare(strict_types=1);

namespace KTXC\Service;

final class FirewallRuleValidator
{
    public const MAX_DEVICE_FINGERPRINT_LENGTH = 512;

    private function __construct()
    {
    }

    public static function ipAddress(string $ipAddress): string
    {
        $ipAddress = trim($ipAddress);
        if (filter_var($ipAddress, \FILTER_VALIDATE_IP) === false) {
            throw new \InvalidArgumentException("Invalid IP address: {$ipAddress}");
        }

        return $ipAddress;
    }

    public static function cidr(string $cidr): string
    {
        $cidr = trim($cidr);
        if (substr_count($cidr, '/') !== 1) {
            throw new \InvalidArgumentException("Invalid CIDR range: {$cidr}");
        }

        [$address, $prefix] = explode('/', $cidr, 2);
        if (filter_var($address, \FILTER_VALIDATE_IP) === false || !ctype_digit($prefix)) {
            throw new \InvalidArgumentException("Invalid CIDR range: {$cidr}");
        }

        $maximumPrefix = str_contains($address, ':') ? 128 : 32;
        if ((int)$prefix > $maximumPrefix) {
            throw new \InvalidArgumentException("Invalid CIDR range: {$cidr}");
        }

        return $cidr;
    }

    public static function deviceFingerprint(string $fingerprint): string
    {
        $fingerprint = trim($fingerprint);
        if ($fingerprint === '' || strlen($fingerprint) > self::MAX_DEVICE_FINGERPRINT_LENGTH) {
            throw new \InvalidArgumentException(
                sprintf('Device fingerprint must contain between 1 and %d bytes.', self::MAX_DEVICE_FINGERPRINT_LENGTH)
            );
        }

        return $fingerprint;
    }

    public static function duration(?int $durationSeconds): void
    {
        if ($durationSeconds !== null && $durationSeconds < 1) {
            throw new \InvalidArgumentException('Firewall rule duration must be greater than zero.');
        }
    }
}