using System.Security.Cryptography.X509Certificates;

namespace Csob.Credentials;

/// <summary>
/// Fully resolved set of per-request credentials and PSU context used to call the ČSOB PSD2 API.
/// Built from request headers by <see cref="RequestCredentialsProvider"/>; never logged.
/// </summary>
public sealed record CsobCredentials
{
    /// <summary>OAuth2 Bearer access token (forwarded as <c>Authorization: Bearer</c>).</summary>
    public required string AccessToken { get; init; }

    /// <summary>ČSOB application API key (forwarded as <c>APIKEY</c>).</summary>
    public required string ApiKey { get; init; }

    /// <summary>TPP organisation name (forwarded as <c>TPP-Name</c>).</summary>
    public required string TppName { get; init; }

    /// <summary>
    /// eIDAS client certificate (with private key) for mutual TLS. Optional at the type level so
    /// metadata endpoints can resolve context, but required for any real upstream call.
    /// </summary>
    public X509Certificate2? Certificate { get; init; }

    /// <summary>Whether the PSU is online for this request (<c>User-Involved</c>); defaults to false.</summary>
    public bool UserInvolved { get; init; }

    /// <summary>Optional PSU IP address (<c>User-IP-Address</c>).</summary>
    public string? UserIpAddress { get; init; }
}