namespace DodoSSH.Domain;

/// <summary>
/// A relay ticket that has been redeemed.
/// </summary>
/// <remarks>
/// <para>
/// The replay guard, and the only state the relay shares between nodes — see ADR 0004. A ticket is
/// verified without the database; what the database adds is that it is verified <em>once</em>, by a
/// unique insert on <see cref="TicketId"/> that a second redemption loses whichever node it reaches.
/// </para>
/// <para>
/// A row is worth keeping only while its ticket could still verify, so <see cref="ExpiresAtUtc"/> is
/// stored to let redemption sweep the rows that can no longer matter. Nothing else reads this table,
/// and it carries nothing about the target: the audit record is <see cref="RelaySession"/>.
/// </para>
/// </remarks>
public sealed class RelayTicketUse
{
    /// <summary>The ticket's own id. Primary key, and the whole of the guard.</summary>
    public Guid TicketId { get; set; }

    /// <summary>When the ticket stops verifying, after which this row guards nothing.</summary>
    public DateTimeOffset ExpiresAtUtc { get; set; }

    /// <summary>When it was redeemed.</summary>
    public DateTimeOffset UsedAtUtc { get; set; }
}

/// <summary>
/// The audit record of one relay session.
/// </summary>
/// <remarks>
/// <para>
/// What ADR 0004 says remains auditable in relay mode, and nothing more: who, to where, for how long,
/// how many bytes each way and why it ended. The relay forwards SSH ciphertext, so there is no content
/// to record and no column that pretends otherwise.
/// </para>
/// <para>
/// Written twice — once when the target answers, once when the session ends — each time from a scope
/// opened for that write alone. A session lasts hours and a scope held across it is a pooled database
/// connection held across it, which is the failure ADR 0004 records.
/// </para>
/// <para>
/// No foreign keys to the host or the vault, deliberately. An audit row has to outlive what it is
/// about: a host deleted a minute after a session is exactly the host an operator will want the
/// session for.
/// </para>
/// </remarks>
public sealed class RelaySession
{
    /// <summary>The session id, minted with the ticket and returned to the client. Primary key.</summary>
    public Guid Id { get; set; }

    /// <summary>Who opened it.</summary>
    public Guid UserId { get; set; }

    /// <summary>The host it reached.</summary>
    public Guid HostId { get; set; }

    /// <summary>The vault the host was in when the ticket was issued.</summary>
    public Guid VaultId { get; set; }

    /// <summary>The hostname as the host row carried it at issue.</summary>
    public string TargetHost { get; set; } = string.Empty;

    /// <summary>The address actually dialled, which is the one that answered.</summary>
    /// <remarks>Null only for a session whose target never answered.</remarks>
    public string? TargetAddress { get; set; }

    /// <summary>The port dialled.</summary>
    public int TargetPort { get; set; }

    /// <summary>The client's address as this node saw it, for the audit ADR 0004 promises.</summary>
    public string? ClientAddress { get; set; }

    /// <summary>When the socket was accepted.</summary>
    public DateTimeOffset StartedAtUtc { get; set; }

    /// <summary>When it closed, or null while it is open — or if the node died under it.</summary>
    public DateTimeOffset? EndedAtUtc { get; set; }

    /// <summary>Bytes forwarded from the client to the target.</summary>
    public long BytesClientToTarget { get; set; }

    /// <summary>Bytes forwarded from the target to the client.</summary>
    public long BytesTargetToClient { get; set; }

    /// <summary>Why it ended. <see cref="RelayCloseReason.Unspecified"/> while open.</summary>
    public RelayCloseReason CloseReason { get; set; }
}

/// <summary>Why a relay session ended.</summary>
/// <remarks>
/// Numbered as <c>RelaySessionCloseReason</c> on the wire is, and held to it by a test rather than by
/// hope: the endpoint converts between the two by value.
/// </remarks>
public enum RelayCloseReason
{
    /// <summary>Not a legal value for a closed session; what an open one carries.</summary>
    Unspecified = 0,

    /// <summary>The client closed the connection.</summary>
    ClientClosed = 1,

    /// <summary>The target closed the connection.</summary>
    TargetClosed = 2,

    /// <summary>No traffic within the idle timeout.</summary>
    IdleTimeout = 3,

    /// <summary>The maximum session duration was reached.</summary>
    DurationLimit = 4,

    /// <summary>The server is shutting down and drained the session.</summary>
    ServerShutdown = 5,

    /// <summary>The connection to the target failed.</summary>
    TargetUnreachable = 6,

    /// <summary>An error ended the session.</summary>
    Error = 7,
}