namespace DodoSSH.Contracts;

/// <summary>
/// Server capabilities, versions and limits.
/// </summary>
/// <remarks>
/// This replaces URL-based API versioning. In a self-hosted product the client and server
/// upgrade independently, so skew is normal rather than exceptional, and a client needs to ask
/// what this particular server supports rather than assume. See ADR 0002.
/// </remarks>
/// <param name="ServerVersion">Informational build version.</param>
/// <param name="ApiVersions">Supported API major versions.</param>
/// <param name="SyncProtocolVersion">
/// Sync semantics version. A mismatch means the client must not push.
/// </param>
/// <param name="CryptoSpecVersion">
/// DSH1 specification version the server's stored data conforms to.
/// </param>
/// <param name="Features">
/// Enabled optional features, such as <c>relay</c> or <c>teams</c>. Absence must be treated as
/// unsupported rather than as an error.
/// </param>
/// <param name="MinClientVersion">
/// Oldest client this server will serve. Clients below this must show a remediation screen
/// rather than failing obscurely.
/// </param>
/// <param name="MaxOperationsPerPush">Cap on operations in one push.</param>
/// <param name="MaxPayloadBytes">Cap on total ciphertext in one push.</param>
/// <param name="MaxItemPayloadBytes">Cap on a single item's ciphertext.</param>
public sealed record MetaResponse(
    string ServerVersion,
    IReadOnlyList<int> ApiVersions,
    int SyncProtocolVersion,
    int CryptoSpecVersion,
    IReadOnlyList<string> Features,
    string? MinClientVersion,
    int MaxOperationsPerPush,
    long MaxPayloadBytes,
    long MaxItemPayloadBytes);

/// <summary>
/// Everything a client needs to begin authenticating, from one URL.
/// </summary>
/// <remarks>
/// Served anonymously at <c>/.well-known/dodossh-configuration</c>. This is the onboarding
/// story: the user types a server URL and the client discovers the rest.
/// </remarks>
/// <param name="ApiBaseUrl">Base URL for API calls.</param>
/// <param name="Oidc">Identity provider settings.</param>
/// <param name="Relay">Relay settings.</param>
public sealed record DodoSshConfiguration(
    Uri ApiBaseUrl,
    OidcConfiguration Oidc,
    RelayConfiguration Relay);

/// <summary>Identity provider settings for a public native client.</summary>
/// <param name="Authority">Issuer URL, from which discovery and JWKS are fetched.</param>
/// <param name="ClientId">Public client identifier.</param>
/// <param name="Scopes">Scopes to request.</param>
/// <param name="LoopbackRedirectPattern">
/// Registered loopback redirect pattern. RFC 8252: a native client uses a loopback redirect on
/// an ephemeral port with the system browser, never a custom scheme and never an embedded
/// browser, so the user can see the real address bar.
/// </param>
public sealed record OidcConfiguration(
    Uri Authority,
    string ClientId,
    IReadOnlyList<string> Scopes,
    string LoopbackRedirectPattern);

/// <summary>Relay settings.</summary>
/// <param name="Enabled">Whether this server offers a relay at all.</param>
/// <param name="WebSocketUrl">Relay endpoint, when enabled.</param>
public sealed record RelayConfiguration(
    bool Enabled,
    Uri? WebSocketUrl);
