<?php

declare(strict_types=1);

namespace KTXC\Service;

use KTXC\Context\IdentityContextInterface;
use KTXC\Context\TenantContextInterface;

final class TenantFirewallStatusService
{
    public const PERMISSION_SETTINGS_READ = 'firewall.tenant.settings.read';
    public const PERMISSION_SETTINGS_MANAGE = 'firewall.tenant.settings.manage';

    public function __construct(
        private readonly FirewallStatusService $status,
        private readonly TenantContextInterface $tenant,
        private readonly IdentityContextInterface $identity,
        private readonly FirewallSettingsService $settings,
    ) {
    }

    public function metrics(?string $since = null): array
    {
        $this->requirePermission(TenantFirewallLogService::PERMISSION_READ);
        return $this->status->tenantMetrics($this->tenant->requireIdentifier(), $since);
    }

    public function configuration(): array
    {
        $this->requirePermission(self::PERMISSION_SETTINGS_READ);
        return $this->tenant->configuration()?->firewall()->jsonSerialize()
            ?? [
                'enabled' => true,
                'maxAuthFailures' => 5,
                'authFailureWindow' => 300,
                'autoBlockDuration' => 3600,
            ];
    }

    public function updateConfiguration(
        bool $enabled,
        int $maxAuthFailures,
        int $authFailureWindow,
        int $autoBlockDuration,
        string $reason
    ): ?array {
        $this->requirePermission(self::PERMISSION_SETTINGS_MANAGE);
        return $this->settings->update(
            $this->tenant->requireIdentifier(),
            $enabled,
            $maxAuthFailures,
            $authFailureWindow,
            $autoBlockDuration,
            $reason,
            $this->identity->identifier()
        );
    }

    private function requirePermission(string $permission): void
    {
        if (!$this->identity->hasPermission($permission)) {
            throw new \RuntimeException("Missing required permission: {$permission}");
        }
    }
}