from __future__ import annotations

import os
from dataclasses import dataclass


def _bool(name: str, default: bool = False) -> bool:
    value = os.getenv(name)
    if value is None:
        return default
    return value.strip().lower() in {"1", "true", "yes", "on"}


def _int(name: str, default: int) -> int:
    value = os.getenv(name)
    if value is None or not value.strip():
        return default
    return int(value)


@dataclass(frozen=True)
class Config:
    tzsp_bind: str
    tzsp_port: int
    tap_name: str
    tap_mtu: int
    suricata_config: str
    suricata_home_net: str
    suricata_local_rules: str
    suricata_extra_rules_glob: str
    suricata_custom_rules: str
    suricata_threshold_config: str
    update_rules_on_start: bool
    rule_update_interval_hours: int
    web_bind: str
    web_port: int
    db_path: str
    eve_path: str
    alert_retention_days: int
    alert_max_severity: int
    alert_dedup_window_seconds: int
    alert_ignore_sids: str
    alert_ignore_categories: str
    auto_block: bool
    auto_block_max_severity: int
    monitored_networks: str
    never_block: str
    block_timeout: str
    routeros_url: str
    routeros_user: str
    routeros_password: str
    routeros_verify_tls: bool
    routeros_address_list: str
    routeros_http_timeout: int
    admin_token: str

    @classmethod
    def from_env(cls) -> "Config":
        return cls(
            tzsp_bind=os.getenv("TZSP_BIND", "0.0.0.0"),
            tzsp_port=_int("TZSP_PORT", 37008),
            tap_name=os.getenv("TAP_NAME", "suritap0"),
            tap_mtu=_int("TAP_MTU", 9000),
            suricata_config=os.getenv("SURICATA_CONFIG", "/etc/suricata/suricata.yaml"),
            suricata_home_net=os.getenv(
                "SURICATA_HOME_NET",
                "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]",
            ),
            suricata_local_rules=os.getenv(
                "SURICATA_LOCAL_RULES", "/data/suricata/local.rules"
            ),
            suricata_extra_rules_glob=os.getenv(
                "SURICATA_EXTRA_RULES_GLOB", "/data/suricata/*.rules"
            ),
            suricata_custom_rules=os.getenv(
                "SURICATA_CUSTOM_RULES", "/data/suricata/custom.rules"
            ),
            suricata_threshold_config=os.getenv(
                "SURICATA_THRESHOLD_CONFIG", "/data/suricata/threshold.config"
            ),
            update_rules_on_start=_bool("UPDATE_RULES_ON_START", False),
            rule_update_interval_hours=_int("RULE_UPDATE_INTERVAL_HOURS", 24),
            web_bind=os.getenv("WEB_BIND", "0.0.0.0"),
            web_port=_int("WEB_PORT", 8080),
            db_path=os.getenv("DB_PATH", "/data/ids.db"),
            eve_path=os.getenv("EVE_PATH", "/var/log/suricata/eve.json"),
            alert_retention_days=_int("ALERT_RETENTION_DAYS", 14),
            # Suricata severity uses 1 as the most important value. Keeping
            # 1-2 by default removes low-priority informational noise from the
            # incident database while raw EVE remains available on disk.
            alert_max_severity=_int("ALERT_MAX_SEVERITY", 2),
            alert_dedup_window_seconds=_int("ALERT_DEDUP_WINDOW_SECONDS", 300),
            alert_ignore_sids=os.getenv("ALERT_IGNORE_SIDS", "1000001"),
            alert_ignore_categories=os.getenv("ALERT_IGNORE_CATEGORIES", ""),
            auto_block=_bool("AUTO_BLOCK", False),
            auto_block_max_severity=_int("AUTO_BLOCK_MAX_SEVERITY", 1),
            monitored_networks=os.getenv("MONITORED_NETWORKS", "192.168.100.0/24"),
            never_block=os.getenv("NEVER_BLOCK", ""),
            block_timeout=os.getenv("BLOCK_TIMEOUT", "1h"),
            routeros_url=os.getenv("ROUTEROS_URL", "https://172.31.255.1").rstrip("/"),
            routeros_user=os.getenv("ROUTEROS_USER", "suricata-api"),
            routeros_password=os.getenv("ROUTEROS_PASSWORD", "CHANGE_ME"),
            routeros_verify_tls=_bool("ROUTEROS_VERIFY_TLS", False),
            routeros_address_list=os.getenv("ROUTEROS_ADDRESS_LIST", "IDS-BLOCK"),
            routeros_http_timeout=_int("ROUTEROS_HTTP_TIMEOUT", 5),
            admin_token=os.getenv("ADMIN_TOKEN", ""),
        )

    def public_dict(self) -> dict:
        return {
            "tzsp_bind": self.tzsp_bind,
            "tzsp_port": self.tzsp_port,
            "tap_name": self.tap_name,
            "tap_mtu": self.tap_mtu,
            "suricata_home_net": self.suricata_home_net,
            "suricata_extra_rules_glob": self.suricata_extra_rules_glob,
            "web_port": self.web_port,
            "rule_update_interval_hours": self.rule_update_interval_hours,
            "alert_retention_days": self.alert_retention_days,
            "alert_max_severity": self.alert_max_severity,
            "alert_dedup_window_seconds": self.alert_dedup_window_seconds,
            "alert_ignore_sids": self.alert_ignore_sids,
            "alert_ignore_categories": self.alert_ignore_categories,
            "auto_block": self.auto_block,
            "auto_block_max_severity": self.auto_block_max_severity,
            "monitored_networks": self.monitored_networks,
            "never_block": self.never_block,
            "block_timeout": self.block_timeout,
            "routeros_url": self.routeros_url,
            "routeros_user": self.routeros_user,
            "routeros_verify_tls": self.routeros_verify_tls,
            "routeros_address_list": self.routeros_address_list,
            "admin_actions_enabled": bool(self.admin_token),
        }