namespace SharedKernel
{
    public sealed class AppSettings
    {
        public AppSection App { get; init; } = new();
        public ConnectionStringsSection ConnectionStrings { get; init; } = new();
        public RedisSection Redis { get; init; } = new();
        public SmtpSection SMTP { get; init; } = new();
        public JwtSection JWT { get; init; } = new();
        public ForwardedHeadersSection ForwardedHeaders { get; init; } = new();
        public CorsPolicySection CorsPolicy { get; init; } = new();
        public EncryptionSection Encryption { get; init; } = new();

        public sealed class AppSection
        {
            public string Name { get; init; } = string.Empty;
            public string Company { get; init; } = string.Empty;
            public string BaseURL { get; init; } = string.Empty;
            public string ApiURL { get; init; } = string.Empty;
            public string FrontURL { get; init; } = string.Empty;
        }

        public sealed class ConnectionStringsSection
        {
            public string DefaultConnection { get; init; } = string.Empty;
            public int Timeout { get; init; }
        }

        public class RedisSection
        {
            public string DefaultConnection { get; init; } = string.Empty;
            public string CachePrefix { get; init; } = string.Empty;
            public string AuthTicketPrefix { get; init; } = string.Empty;
            public string DataProtectionKey { get; init; } = string.Empty;
            public TimeSpan DefaultKeyLifetime { get; init; }
        }

        public class SmtpSection
        {
            public string Host { get; init; } = default!;
            public int Port { get; init; } = 587;
            public string? User { get; init; }
            public string? Password { get; init; }
            public bool UseStartTls { get; init; } = true;
            public string FromEmail { get; init; } = default!;
            public string FromName { get; init; } = "no-reply";
        }

        public class JwtSection
        {
            public string SecretKey { get; init; } = string.Empty;
            public string Issuer { get; init; } = string.Empty;
            public string Audience { get; init; } = string.Empty;
            public int AccessTokenExpiration { get; init; }
            public int RefreshTokenExpiration { get; init; }
        }

        public class ForwardedHeadersSection
        {
            public int? ForwardLimit { get; init; } = default;
            public List<string> KnownProxies { get; init; } = [];
            public List<string> KnownNetworks { get; init; } = [];
        }

        public class CorsPolicySection
        {
            public string Name { get; init; } = string.Empty;
            public long PreflightMaxAgeSeconds { get; init; } = 0;
            public List<string> AllowedOrigins { get; init; } = [];
        }

        /// <summary>
        /// 필드 단위 암호화(AES-256-GCM) 키 설정.
        /// Keys 딕셔너리는 "V{int}" -> Base64(32바이트) 매핑. CurrentKeyVersion 은 신규 암호화에 사용할 버전.
        /// 키 회전 시 Keys 에 새 버전 추가 + CurrentKeyVersion 갱신. 복호화는 저장된 KeyVersion 으로 과거 키 매핑.
        /// 실제 키 값은 커밋 금지 — user-secrets/환경변수/로컬 설정으로 주입.
        /// </summary>
        public class EncryptionSection
        {
            public int CurrentKeyVersion { get; init; } = 1;
            public Dictionary<string, string> Keys { get; init; } = new();
        }
    }
}