// Package security provides HTTP security middleware, authentication,
// and rate limiting backed by a database.
//
//	security.New(
//	    security.WithNonce(),
//	    security.WithHeaders(),
//	    security.WithRateLimit(db, 100, 60),
//	)
package security

import (
	"net/http"

	"congo.gg/pkg/database"
)

// Policy composes security middleware into a single handler chain.
type Policy struct {
	useNonce   bool
	useHeaders bool
	rateLimitDB     *database.Database
	rateLimitMax    int
	rateLimitWindow int // seconds
}

// Option configures a security policy.
type Option func(*Policy)

// WithNonce enables per-request CSP nonce generation.
func WithNonce() Option {
	return func(p *Policy) { p.useNonce = true }
}

// WithHeaders enables security response headers (CSP, X-Frame-Options, etc).
func WithHeaders() Option {
	return func(p *Policy) { p.useHeaders = true }
}

// WithRateLimit enables IP-based rate limiting backed by a database.
// n is the max requests per window. windowSeconds is the time period.
func WithRateLimit(db *database.Database, n, windowSeconds int) Option {
	return func(p *Policy) {
		p.rateLimitDB = db
		p.rateLimitMax = n
		p.rateLimitWindow = windowSeconds
	}
}

// New creates a security policy middleware from functional options.
// The returned middleware composes all enabled features into one handler.
func New(opts ...Option) func(http.Handler) http.Handler {
	p := &Policy{}
	for _, opt := range opts {
		opt(p)
	}

	return func(next http.Handler) http.Handler {
		h := next

		// Rate limiting (innermost — check before processing)
		if p.rateLimitMax > 0 && p.rateLimitDB != nil {
			h = rateLimit(p.rateLimitDB, p.rateLimitMax, p.rateLimitWindow, h)
		}

		// Security headers
		if p.useHeaders {
			h = headers(h)
		}

		// Nonce (outermost — sets context for headers)
		if p.useNonce {
			h = nonce(h)
		}

		return h
	}
}