/**
 * Zone Policy Enforcement
 * Validates that modules providing well-known capabilities are deployed to appropriate zones
 */

import type { NetworkZone } from '../db/schema';

/**
 * Validation result
 */
export interface ValidationResult {
  valid: boolean;
  error?: string;
}

/**
 * Zone requirements for well-known capabilities
 *
 * Security policy: Certain capabilities must be deployed to specific zones
 * to maintain security boundaries.
 */
const ZONE_REQUIREMENTS: Record<string, NetworkZone> = {
  // Public web services must be in DMZ (defense perimeter)
  public_web: 'dmz',

  // Future capabilities:
  // idp: 'secure',           // Identity provider (sensitive)
  // database: 'secure',      // Databases (sensitive data)
  // dns_internal: 'internal', // Internal DNS (backbone service)
};

/**
 * Get zone requirement for a capability (if any)
 *
 * Policy function (Rule 10.1) - pure lookup
 *
 * @param capability - Capability name
 * @returns Required zone, or null if no requirement
 */
export function getZoneRequirement(capability: string): NetworkZone | null {
  return ZONE_REQUIREMENTS[capability] || null;
}

/**
 * Validate that a capability is being deployed to the correct zone
 *
 * Policy function (Rule 10.1) - validation only
 *
 * @param capability - Capability name
 * @param zone - Zone where module will be deployed
 * @returns Validation result with error message if invalid
 */
export function validateZoneRequirement(capability: string, zone: NetworkZone): ValidationResult {
  const required = ZONE_REQUIREMENTS[capability];

  if (required && zone !== required) {
    return {
      valid: false,
      error: `Capability '${capability}' requires zone='${required}' (security requirement). Module specifies zone='${zone}'.`,
    };
  }

  return { valid: true };
}

/**
 * Validate zone requirements for all capabilities provided by a module
 *
 * Policy function - validates multiple capabilities
 *
 * @param capabilities - Array of capability names provided by module
 * @param zone - Zone where module will be deployed
 * @returns Validation result with combined error messages
 */
export function validateModuleZoneRequirements(
  capabilities: string[],
  zone: NetworkZone,
): ValidationResult {
  const errors: string[] = [];

  for (const capability of capabilities) {
    const result = validateZoneRequirement(capability, zone);
    if (!result.valid && result.error) {
      errors.push(result.error);
    }
  }

  if (errors.length > 0) {
    return {
      valid: false,
      error: errors.join('\n'),
    };
  }

  return { valid: true };
}

/**
 * Check if a zone field is required for a module
 *
 * Policy function - determines if zone validation applies
 *
 * Zone is required if:
 * - Module specifies requires.system (infrastructure provisioning)
 *
 * Zone is optional if:
 * - Module has no infrastructure requirements (e.g., VPS-based modules)
 *
 * @param hasInfrastructureSpec - Whether module has requires.system
 * @returns True if zone field is required
 */
export function isZoneRequired(hasInfrastructureSpec: boolean): boolean {
  return hasInfrastructureSpec;
}

/**
 * Get list of all capability zone requirements (for documentation/help)
 *
 * @returns Array of capability requirements
 */
export function getZoneRequirements(): Array<{ capability: string; zone: NetworkZone }> {
  return Object.entries(ZONE_REQUIREMENTS).map(([capability, zone]) => ({
    capability,
    zone,
  }));
}