package domain

import (
	"context"
	"time"
)

type Actor struct {
	Name               string
	Role               string
	Permissions        map[string]bool
	PortAccess         map[string]string
	MustChangePassword bool
}

type AuthProfile struct {
	Actor              string           `json:"actor"`
	Role               string           `json:"role"`
	Permissions        []string         `json:"permissions"`
	Prototype          bool             `json:"prototype"`
	PortPermissions    []PortPermission `json:"port_permissions"`
	MustChangePassword bool             `json:"must_change_password"`
}

type PortPermission struct {
	Channel string `json:"channel"`
	Access  string `json:"access"`
}

type AuthLoginRequest struct {
	Username      string `json:"username"`
	Password      string `json:"password"`
	CaptchaID     string `json:"captcha_id,omitempty"`
	CaptchaAnswer string `json:"captcha_answer,omitempty"`
}

type AuthLoginPolicy struct {
	CaptchaEnabled       bool `json:"captcha_enabled"`
	DetectionMinutes     int  `json:"login_detection_minutes"`
	SecurityHitCount     int  `json:"login_security_hit_count"`
	FixedSafetyThreshold int  `json:"fixed_safety_threshold"`
	FixedSafetyMinutes   int  `json:"fixed_safety_minutes"`
}

type AuthUserCreateRequest struct {
	Username        string           `json:"username"`
	Password        string           `json:"password"`
	Role            string           `json:"role"`
	Groups          []string         `json:"groups,omitempty"`
	PortPermissions []PortPermission `json:"port_permissions,omitempty"`
	ForceChange     *bool            `json:"force_change,omitempty"`
}

type AuthUserUpdateRequest struct {
	Enabled         *bool             `json:"enabled,omitempty"`
	Role            *string           `json:"role,omitempty"`
	Groups          *[]string         `json:"groups,omitempty"`
	PortPermissions *[]PortPermission `json:"port_permissions,omitempty"`
}

type AuthUserPasswordUpdateRequest struct {
	Password    string `json:"password"`
	ForceChange *bool  `json:"force_change,omitempty"`
}

type AuthSelfPasswordUpdateRequest struct {
	CurrentPassword string `json:"current_password"`
	NewPassword     string `json:"new_password"`
	ConfirmPassword string `json:"confirm_password"`
}

type AuthGroupCreateRequest struct {
	GroupID         string           `json:"group_id"`
	Name            string           `json:"name"`
	Role            string           `json:"role"`
	Permissions     []string         `json:"permissions,omitempty"`
	PortPermissions []PortPermission `json:"port_permissions,omitempty"`
}

type AuthGroupUpdateRequest struct {
	Name            *string           `json:"name,omitempty"`
	Role            *string           `json:"role,omitempty"`
	Permissions     *[]string         `json:"permissions,omitempty"`
	PortPermissions *[]PortPermission `json:"port_permissions,omitempty"`
}

type AuthSession struct {
	SessionToken       string           `json:"session_token"`
	Actor              string           `json:"actor"`
	Role               string           `json:"role"`
	Permissions        []string         `json:"permissions"`
	Prototype          bool             `json:"prototype"`
	ExpiresAt          time.Time        `json:"expires_at"`
	Persistent         bool             `json:"persistent"`
	PortPermissions    []PortPermission `json:"port_permissions"`
	MustChangePassword bool             `json:"must_change_password"`
}

type AuthSessionInfo struct {
	SessionID  string    `json:"session_id"`
	Actor      string    `json:"actor"`
	Role       string    `json:"role"`
	CreatedAt  time.Time `json:"created_at"`
	ExpiresAt  time.Time `json:"expires_at"`
	Persistent bool      `json:"persistent"`
}

type AuthTokenCreateRequest struct {
	Name      string     `json:"name"`
	Username  string     `json:"username,omitempty"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type AuthTokenCreateResult struct {
	TokenID   string     `json:"token_id"`
	Token     string     `json:"token"`
	Name      string     `json:"name"`
	Actor     string     `json:"actor"`
	Role      string     `json:"role"`
	CreatedAt time.Time  `json:"created_at"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type AuthTokenInfo struct {
	TokenID    string     `json:"token_id"`
	Name       string     `json:"name"`
	Actor      string     `json:"actor"`
	Role       string     `json:"role"`
	CreatedAt  time.Time  `json:"created_at"`
	ExpiresAt  *time.Time `json:"expires_at,omitempty"`
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
}

type AuthUser struct {
	Username           string           `json:"username"`
	Actor              string           `json:"actor"`
	Role               string           `json:"role"`
	Groups             []string         `json:"groups"`
	Permissions        []string         `json:"permissions"`
	Enabled            bool             `json:"enabled"`
	PortPermissions    []PortPermission `json:"port_permissions"`
	MustChangePassword bool             `json:"must_change_password"`
}

type AuthGroup struct {
	GroupID         string           `json:"group_id"`
	Name            string           `json:"name"`
	Role            string           `json:"role"`
	Permissions     []string         `json:"permissions"`
	Members         []string         `json:"members"`
	PortPermissions []PortPermission `json:"port_permissions"`
	System          bool             `json:"system"`
}

type AuthPermission struct {
	Permission  string `json:"permission"`
	Description string `json:"description"`
	Sensitive   bool   `json:"sensitive"`
}

type ExternalAuthSettings struct {
	Enabled        bool                 `json:"enabled"`
	PrimaryMethod  string               `json:"primary_method"`
	LocalFallback  bool                 `json:"local_fallback"`
	TimeoutSeconds int                  `json:"timeout_seconds"`
	RadiusServers  []ExternalAuthServer `json:"radius_servers"`
	TACACSServers  []ExternalAuthServer `json:"tacacs_servers"`
	DefaultRole    string               `json:"default_role"`
}

type ExternalAuthServer struct {
	ServerID     string `json:"server_id"`
	Host         string `json:"host"`
	Port         int    `json:"port"`
	SecretStored bool   `json:"secret_stored"`
	Enabled      bool   `json:"enabled"`
	Secret       string `json:"secret,omitempty"`
	ClearSecret  bool   `json:"clear_secret,omitempty"`
}

type ExternalAuthUpdate struct {
	Enabled        *bool                `json:"enabled,omitempty"`
	PrimaryMethod  *string              `json:"primary_method,omitempty"`
	LocalFallback  *bool                `json:"local_fallback,omitempty"`
	TimeoutSeconds *int                 `json:"timeout_seconds,omitempty"`
	RadiusServers  []ExternalAuthServer `json:"radius_servers,omitempty"`
	TACACSServers  []ExternalAuthServer `json:"tacacs_servers,omitempty"`
	DefaultRole    *string              `json:"default_role,omitempty"`
}

type AddressFilterSettings struct {
	Enabled bool                `json:"enabled"`
	Mode    string              `json:"mode"`
	Rules   []AddressFilterRule `json:"rules"`
}

type AddressFilterRule struct {
	RuleID          string `json:"rule_id"`
	AddressType     string `json:"address_type"`
	Address         string `json:"address"`
	Protocol        string `json:"protocol"`
	DestinationPort int    `json:"destination_port"`
	Enabled         bool   `json:"enabled"`
}

type actorContextKey struct{}
type commandMetadataContextKey struct{}

type CommandMetadata struct {
	Surface string
	Command string
}

func WithActor(ctx context.Context, actor Actor) context.Context {
	return context.WithValue(ctx, actorContextKey{}, actor)
}

func ActorFromContext(ctx context.Context) (Actor, bool) {
	actor, ok := ctx.Value(actorContextKey{}).(Actor)
	return actor, ok
}

func ActorName(ctx context.Context) string {
	actor, ok := ActorFromContext(ctx)
	if !ok || actor.Name == "" {
		return "anonymous"
	}
	return actor.Name
}

func WithCommandMetadata(ctx context.Context, metadata CommandMetadata) context.Context {
	return context.WithValue(ctx, commandMetadataContextKey{}, metadata)
}

func CommandMetadataFromContext(ctx context.Context) (CommandMetadata, bool) {
	metadata, ok := ctx.Value(commandMetadataContextKey{}).(CommandMetadata)
	return metadata, ok
}