from __future__ import annotations

import os
from dataclasses import dataclass


def _bool(name: str, default: bool = False) -> bool:
    value = os.getenv(name)
    if value is None:
        return default
    return value.strip().lower() in {"1", "true", "yes", "on"}


def _int(name: str, default: int) -> int:
    value = os.getenv(name)
    if value is None or not value.strip():
        return default
    return int(value)


@dataclass(frozen=True)
class Config:
    tzsp_bind: str
    tzsp_port: int
    tap_name: str
    tap_mtu: int
    suricata_config: str
    suricata_home_net: str
    update_rules_on_start: bool
    web_bind: str
    web_port: int
    db_path: str
    eve_path: str
    alert_retention_days: int
    auto_block: bool
    auto_block_max_severity: int
    monitored_networks: str
    never_block: str
    block_timeout: str
    routeros_url: str
    routeros_user: str
    routeros_password: str
    routeros_verify_tls: bool
    routeros_address_list: str
    routeros_http_timeout: int

    @classmethod
    def from_env(cls) -> "Config":
        return cls(
            tzsp_bind=os.getenv("TZSP_BIND", "0.0.0.0"),
            tzsp_port=_int("TZSP_PORT", 37008),
            tap_name=os.getenv("TAP_NAME", "suritap0"),
            tap_mtu=_int("TAP_MTU", 9000),
            suricata_config=os.getenv("SURICATA_CONFIG", "/etc/suricata/suricata.yaml"),
            suricata_home_net=os.getenv(
                "SURICATA_HOME_NET",
                "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]",
            ),
            update_rules_on_start=_bool("UPDATE_RULES_ON_START", False),
            web_bind=os.getenv("WEB_BIND", "0.0.0.0"),
            web_port=_int("WEB_PORT", 8080),
            db_path=os.getenv("DB_PATH", "/data/ids.db"),
            eve_path=os.getenv("EVE_PATH", "/var/log/suricata/eve.json"),
            alert_retention_days=_int("ALERT_RETENTION_DAYS", 14),
            auto_block=_bool("AUTO_BLOCK", False),
            auto_block_max_severity=_int("AUTO_BLOCK_MAX_SEVERITY", 1),
            monitored_networks=os.getenv("MONITORED_NETWORKS", "192.168.100.0/24"),
            never_block=os.getenv("NEVER_BLOCK", ""),
            block_timeout=os.getenv("BLOCK_TIMEOUT", "1h"),
            routeros_url=os.getenv("ROUTEROS_URL", "https://172.31.255.1").rstrip("/"),
            routeros_user=os.getenv("ROUTEROS_USER", "suricata-api"),
            routeros_password=os.getenv("ROUTEROS_PASSWORD", "CHANGE_ME"),
            routeros_verify_tls=_bool("ROUTEROS_VERIFY_TLS", False),
            routeros_address_list=os.getenv("ROUTEROS_ADDRESS_LIST", "IDS-BLOCK"),
            routeros_http_timeout=_int("ROUTEROS_HTTP_TIMEOUT", 5),
        )

    def public_dict(self) -> dict:
        return {
            "tzsp_bind": self.tzsp_bind,
            "tzsp_port": self.tzsp_port,
            "tap_name": self.tap_name,
            "tap_mtu": self.tap_mtu,
            "suricata_home_net": self.suricata_home_net,
            "web_port": self.web_port,
            "auto_block": self.auto_block,
            "auto_block_max_severity": self.auto_block_max_severity,
            "monitored_networks": self.monitored_networks,
            "never_block": self.never_block,
            "block_timeout": self.block_timeout,
            "routeros_url": self.routeros_url,
            "routeros_user": self.routeros_user,
            "routeros_verify_tls": self.routeros_verify_tls,
            "routeros_address_list": self.routeros_address_list,
        }