namespace Csob.Credentials;

/// <summary>
/// Names of the HTTP headers that carry per-request ČSOB credentials and context.
///
/// This service is multi-tenant: it stores no credentials itself. Every sensitive value is
/// supplied per request in a header (never the query string or body) and is forwarded to ČSOB.
/// Headers must therefore only be sent over TLS. Nothing here is logged or persisted.
/// </summary>
public static class CredentialConstants
{
    /// <summary>
    /// eIDAS client certificate (QWAC) as a Base64-encoded PKCS#12 / PFX bundle, including the
    /// private key and the full chain. Used to establish the mutual-TLS connection to ČSOB.
    /// Analogous to Node's <c>https.Agent({ pfx, passphrase })</c>.
    /// </summary>
    public const string CertificateHeader = "X-CSOB-Certificate";

    /// <summary>Optional passphrase protecting the PFX in <see cref="CertificateHeader"/>.</summary>
    public const string CertificatePasswordHeader = "X-CSOB-Certificate-Password";

    /// <summary>OAuth2 Bearer access token obtained for the PSU; forwarded as <c>Authorization: Bearer</c>.</summary>
    public const string AccessTokenHeader = "X-Access-Token";

    /// <summary>ČSOB application API key; forwarded as the <c>APIKEY</c> header.</summary>
    public const string ApiKeyHeader = "X-API-Key";

    /// <summary>TPP (third-party provider) organisation name; forwarded as the <c>TPP-Name</c> header.</summary>
    public const string TppNameHeader = "X-TPP-Name";

    /// <summary>OAuth2 client id of the registered TPP application (used by the OAuth helper endpoints).</summary>
    public const string ClientIdHeader = "X-CSOB-Client-Id";

    /// <summary>OAuth2 client secret of the registered TPP application (used by the OAuth helper endpoints).</summary>
    public const string ClientSecretHeader = "X-CSOB-Client-Secret";

    // Optional PSU (end-user) context, forwarded verbatim to ČSOB when present.

    /// <summary>Whether the PSU is online/involved in the request; forwarded as <c>User-Involved</c> (default false).</summary>
    public const string UserInvolvedHeader = "X-User-Involved";

    /// <summary>PSU IP address; forwarded as <c>User-IP-Address</c>.</summary>
    public const string UserIpAddressHeader = "X-User-IP-Address";
}