using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Nexus.Api.Models;

namespace Nexus.Api.Controllers;

[ApiController]
[Authorize]
[Route("api/v1/security")]
public class SecurityController(IConfiguration config) : ControllerBase
{
    [HttpGet("status")]
    [ProducesResponseType(typeof(SecurityStatusDto), StatusCodes.Status200OK)]
    public IResult GetStatus()
    {
        var jwtIssuer = config["Jwt:Issuer"] ?? "nexus";
        var jwtAudience = config["Jwt:Audience"] ?? "nexus-web";
        var refreshDays = config.GetValue<int>("Jwt:RefreshTokenExpirationDays", 7);
        var accessTokenMinutes = config.GetValue<int>("Jwt:AccessTokenExpirationMinutes", 30);

        return Results.Ok(new SecurityStatusDto(
            "JWT + PBKDF2",
            new SecurityTokenConfigDto(
                jwtIssuer,
                jwtAudience,
                refreshDays,
                accessTokenMinutes),
            "5 login attempts per minute per IP",
            "Minimum 10 characters",
            new SecurityCookieConfigDto(
                HttpOnly: true,
                Secure: true,
                SameSite: "Strict"),
            TwoFactorEnabled: false,
            PasskeyEnabled: false,
            DateTimeOffset.UtcNow));
    }
}