/**
 * @module common/keystone-policies
 *
 * Centralized identity and security policies for the space-gib application.
 * Defines standard configurations for both persistent (Domain) and ephemeral (Session) keystones.
 *
 * ## important
 *
 * This file is part of the `src/common` layer. It MUST NEVER import from
 * `src/client` or `src/server`.
 */

import { HashAlgorithm } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
import {
    SESSION_KEYSTONE_POLICY as CORE_SESSION_KEYSTONE_POLICY,
    getConnectChallenge as coreGetConnectChallenge,
    checkConnectSolution as coreCheckConnectSolution
} from '@ibgib/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs';
import { createPoolConfigFromJson, KeystonePoolTemplate } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
import { KeystonePoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';

import rawPolicies from './keystone-policies.json' with { type: 'json' };

// ---------------------------------------------------------------------------
// 1. JSON Configuration Mapping & Hybrid Fallbacks
// ---------------------------------------------------------------------------

export const pools = rawPolicies.pools as unknown as Record<string, KeystonePoolTemplate>;

/**
 * Resolves a pool config by key from the JSON policy file, with fallback behavior.
 */
export function getSpaceGibPoolConfig(poolKey: string, salt: string): KeystonePoolConfig {
    const template = pools[poolKey];
    if (!template) {
        throw new Error(`Pool template not found in space-gib JSON config: ${poolKey}`);
    }
    return createPoolConfigFromJson({
        template,
        salt
    });
}

// ---------------------------------------------------------------------------
// 2. Compatibility Layer: Session Keystone (S) Policies
// ---------------------------------------------------------------------------

/**
 * Default configurations for short-lived session keystones (S^Stjp).
 * These values match the real-world usage in the space-gib client.
 */
export const SESSION_KEYSTONE_POLICY = {
    /**
     * Shared parameters across all session pools
     */
    COMMON: CORE_SESSION_KEYSTONE_POLICY.COMMON,

    /**
     * The primary authorization pool for sync actions (e.g. putting/getting ibgibs).
     */
    DEFAULT_POOL: {
        ID: 'default',
        SIZE: 20,
        SELECT_SEQUENTIALLY: 2,
        SELECT_RANDOMLY: 2,
        /**
         * We want more for this, with future implementations we will not have
         * resource exhaustion.
         */
        TARGET_BINDING_COUNT: 3,
    },

    /**
     * Dedicated pool for the WebSocket sync protocol handshake.
     */
    CONNECT_POOL: CORE_SESSION_KEYSTONE_POLICY.CONNECT_POOL
} as const;


// ---------------------------------------------------------------------------
// 3. Compatibility Layer: Domain/Identity Keystone (I) Policies
// ---------------------------------------------------------------------------

/**
 * Server-side minimum requirements for long-lived primary identity keystones.
 */
export const DOMAIN_KEYSTONE_SECURITY_STANDARDS = {
    MIN_DEFAULT_POOL_SIZE: 50,
    ALLOWED_ALGORITHMS: [
        HashAlgorithm.sha_256,
        HashAlgorithm.sha_512
    ],
} as const;


// ---------------------------------------------------------------------------
// 4. Upfront Picket-Fence Connect Helpers
// ---------------------------------------------------------------------------

/**
 * Returns the lexicographically first challenge from the session keystone's
 * 'connect' pool to be used as a deterministic, dynamic upfront pre-filter challenge.
 */
export const getConnectChallenge = coreGetConnectChallenge;

/**
 * Cryptographically validates the upfront picket-fence solution against the session keystone.
 * Verifies that the client solved the lexicographically first challenge from the 'connect' pool.
 */
export const checkConnectSolution = coreCheckConnectSolution;