namespace w4c_workflows.Services.Security;

/// <summary>
/// Operator policy for outbound HTTP issued by workflow nodes. Bound from the
/// <c>Nodes:Egress</c> configuration section. The defaults are fail-closed:
/// private, loopback, link-local and other reserved ranges are denied unless an
/// operator explicitly opts in through <see cref="AllowedHosts"/> or
/// <see cref="AllowPrivateNetworks"/>.
/// </summary>
public sealed class EgressPolicyOptions
{
    /// <summary>Configuration section this policy binds from.</summary>
    public const string SectionName = "Nodes:Egress";

    /// <summary>
    /// Permit requests whose target resolves into a private or reserved range.
    /// Leave <c>false</c> in hosted environments; opt in per host instead.
    /// </summary>
    public bool AllowPrivateNetworks { get; set; }

    /// <summary>
    /// Schemes a node may target. Anything outside the list is rejected, which
    /// keeps file/gopher/data URIs out of the HTTP executor entirely.
    /// </summary>
    public string[] AllowedSchemes { get; set; } = ["https", "http"];

    /// <summary>
    /// Explicit allow-list of hosts that bypass the address-range checks (for
    /// example a documented internal API). Supports an exact host and a
    /// <c>*.example.com</c> suffix wildcard.
    /// </summary>
    public string[] AllowedHosts { get; set; } = [];

    /// <summary>Explicit deny-list of hosts; a match always blocks the request.</summary>
    public string[] BlockedHosts { get; set; } = [];

    /// <summary>
    /// Hard ceiling for redirects a single node invocation may follow. A
    /// workflow can ask for fewer, never more.
    /// </summary>
    public int MaxRedirects { get; set; } = 5;
}