rustauth-core 0.2.0

use std::fmt;
use std::future::Future;
use std::pin::Pin;
use std::sync::Arc;
use std::time::Duration;
use time::Duration as TimeDuration;

use http::Request;

use super::model_schema::ModelSchemaOptions;
use crate::error::RustAuthError;

/// Rate limiting defaults.
#[derive(Clone)]
pub struct RateLimitOptions {
    pub schema: ModelSchemaOptions,
    pub enabled: Option<bool>,
    pub window: TimeDuration,
    pub max: u64,
    pub storage: RateLimitStorageOption,
    pub custom_rules: Vec<RateLimitPathRule>,
    pub dynamic_rules: Vec<DynamicRateLimitPathRule>,
    pub custom_store: Option<Arc<dyn RateLimitStore>>,
    pub custom_storage: Option<Arc<dyn RateLimitStorage>>,
    pub hybrid: HybridRateLimitOptions,
    pub memory_cleanup_interval: Option<Duration>,
    pub missing_ip_policy: MissingIpPolicy,
}

impl Default for RateLimitOptions {
    fn default() -> Self {
        Self {
            schema: ModelSchemaOptions::default(),
            enabled: None,
            window: TimeDuration::seconds(10),
            max: 100,
            storage: RateLimitStorageOption::Memory,
            custom_rules: Vec::new(),
            dynamic_rules: Vec::new(),
            custom_store: None,
            custom_storage: None,
            hybrid: HybridRateLimitOptions::default(),
            memory_cleanup_interval: Some(Duration::from_secs(60 * 60)),
            missing_ip_policy: MissingIpPolicy::default(),
        }
    }
}

impl RateLimitOptions {
    pub fn new() -> Self {
        Self::default()
    }

    pub fn builder() -> Self {
        Self::new()
    }

    #[must_use]
    pub fn schema(mut self, schema: ModelSchemaOptions) -> Self {
        self.schema = schema;
        self
    }

    pub fn memory() -> Self {
        Self {
            storage: RateLimitStorageOption::Memory,
            ..Self::default()
        }
    }

    pub fn database<S>(store: S) -> Self
    where
        S: RateLimitStore,
    {
        Self::database_arc(Arc::new(store))
    }

    pub fn database_arc(store: Arc<dyn RateLimitStore>) -> Self {
        Self {
            storage: RateLimitStorageOption::Database,
            custom_store: Some(store),
            ..Self::default()
        }
    }

    pub fn secondary_storage<S>(store: S) -> Self
    where
        S: RateLimitStore,
    {
        Self::secondary_storage_arc(Arc::new(store))
    }

    pub fn secondary_storage_arc(store: Arc<dyn RateLimitStore>) -> Self {
        Self {
            storage: RateLimitStorageOption::SecondaryStorage,
            custom_store: Some(store),
            ..Self::default()
        }
    }

    #[must_use]
    pub fn enabled(mut self, enabled: bool) -> Self {
        self.enabled = Some(enabled);
        self
    }

    #[must_use]
    pub fn window(mut self, window: TimeDuration) -> Self {
        self.window = window;
        self
    }

    #[must_use]
    pub fn max(mut self, max: u64) -> Self {
        self.max = max;
        self
    }

    #[must_use]
    pub fn storage(mut self, storage: RateLimitStorageOption) -> Self {
        self.storage = storage;
        self
    }

    #[must_use]
    pub fn custom_store<S>(mut self, store: S) -> Self
    where
        S: RateLimitStore,
    {
        self.custom_store = Some(Arc::new(store));
        self
    }

    #[must_use]
    pub fn custom_store_arc(mut self, store: Arc<dyn RateLimitStore>) -> Self {
        self.custom_store = Some(store);
        self
    }

    #[must_use]
    pub fn custom_storage(mut self, storage: Arc<dyn RateLimitStorage>) -> Self {
        self.custom_storage = Some(storage);
        self
    }

    #[must_use]
    pub fn custom_rule(mut self, path: impl Into<String>, rule: RateLimitRule) -> Self {
        self.custom_rules.push(RateLimitPathRule {
            path: path.into(),
            rule: Some(rule),
        });
        self
    }

    #[must_use]
    pub fn disabled_path(mut self, path: impl Into<String>) -> Self {
        self.custom_rules.push(RateLimitPathRule {
            path: path.into(),
            rule: None,
        });
        self
    }

    #[must_use]
    pub fn dynamic_rule<P>(mut self, path: impl Into<String>, provider: P) -> Self
    where
        P: RateLimitRuleProvider,
    {
        self.dynamic_rules
            .push(DynamicRateLimitPathRule::new(path, provider));
        self
    }

    #[must_use]
    pub fn hybrid(mut self, hybrid: HybridRateLimitOptions) -> Self {
        self.hybrid = hybrid;
        self
    }

    #[must_use]
    pub fn memory_cleanup_interval(mut self, interval: Option<Duration>) -> Self {
        self.memory_cleanup_interval = interval;
        self
    }

    #[must_use]
    pub fn missing_ip_policy(mut self, policy: MissingIpPolicy) -> Self {
        self.missing_ip_policy = policy;
        self
    }
}

impl fmt::Debug for RateLimitOptions {
    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
        formatter
            .debug_struct("RateLimitOptions")
            .field("enabled", &self.enabled)
            .field("window", &self.window)
            .field("max", &self.max)
            .field("storage", &self.storage)
            .field("custom_rules", &self.custom_rules)
            .field("dynamic_rules", &self.dynamic_rules)
            .field(
                "custom_store",
                &self.custom_store.as_ref().map(|_| "<custom-store>"),
            )
            .field(
                "custom_storage",
                &self.custom_storage.as_ref().map(|_| "<custom-storage>"),
            )
            .field("hybrid", &self.hybrid)
            .field("memory_cleanup_interval", &self.memory_cleanup_interval)
            .field("missing_ip_policy", &self.missing_ip_policy)
            .finish()
    }
}

/// A single rate-limit bucket rule.
///
/// `window` is the sliding window length in **seconds** (not milliseconds).
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RateLimitRule {
    /// Sliding window length in seconds.
    pub window: TimeDuration,
    pub max: u64,
}

impl RateLimitRule {
    pub fn new(window: TimeDuration, max: u64) -> Self {
        Self { window, max }
    }
}

/// Rejects invalid rate-limit rules before any store consumes a record.
pub fn validate_rate_limit_rule(rule: &RateLimitRule) -> Result<i64, RustAuthError> {
    if rule.window.is_zero() {
        return Err(RustAuthError::InvalidConfig(
            "rate limit window must be greater than zero".to_owned(),
        ));
    }
    if rule.max == 0 {
        return Err(RustAuthError::InvalidConfig(
            "rate limit max must be greater than zero".to_owned(),
        ));
    }
    let milliseconds = rule.window.whole_milliseconds();
    if milliseconds <= 0 {
        return Err(RustAuthError::InvalidConfig(
            "rate limit window must be greater than zero".to_owned(),
        ));
    }
    let window_ms = i64::try_from(milliseconds)
        .map_err(|_| RustAuthError::InvalidConfig("rate limit window is too large".to_owned()))?;
    i64::try_from(rule.max)
        .map_err(|_| RustAuthError::InvalidConfig("rate limit max must fit in i64".to_owned()))?;
    Ok(window_ms)
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct HybridRateLimitOptions {
    pub enabled: bool,
    pub local_multiplier: u64,
}

impl Default for HybridRateLimitOptions {
    fn default() -> Self {
        Self {
            enabled: false,
            local_multiplier: 2,
        }
    }
}

impl HybridRateLimitOptions {
    pub fn new() -> Self {
        Self::default()
    }

    pub fn builder() -> Self {
        Self::new()
    }

    pub fn enabled() -> Self {
        Self {
            enabled: true,
            ..Self::default()
        }
    }

    pub fn disabled() -> Self {
        Self::default()
    }

    #[must_use]
    pub fn set_enabled(mut self, enabled: bool) -> Self {
        self.enabled = enabled;
        self
    }

    #[must_use]
    pub fn local_multiplier(mut self, multiplier: u64) -> Self {
        self.local_multiplier = multiplier;
        self
    }
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RateLimitPathRule {
    pub path: String,
    pub rule: Option<RateLimitRule>,
}

pub trait RateLimitRuleProvider: Send + Sync + 'static {
    fn resolve(
        &self,
        request: &Request<Vec<u8>>,
        current_rule: &RateLimitRule,
    ) -> Result<Option<RateLimitRule>, RustAuthError>;
}

impl<F> RateLimitRuleProvider for F
where
    F: Fn(&Request<Vec<u8>>, &RateLimitRule) -> Result<Option<RateLimitRule>, RustAuthError>
        + Send
        + Sync
        + 'static,
{
    fn resolve(
        &self,
        request: &Request<Vec<u8>>,
        current_rule: &RateLimitRule,
    ) -> Result<Option<RateLimitRule>, RustAuthError> {
        self(request, current_rule)
    }
}

#[derive(Clone)]
pub struct DynamicRateLimitPathRule {
    pub path: String,
    pub provider: Arc<dyn RateLimitRuleProvider>,
}

impl DynamicRateLimitPathRule {
    pub fn new<P>(path: impl Into<String>, provider: P) -> Self
    where
        P: RateLimitRuleProvider,
    {
        Self {
            path: path.into(),
            provider: Arc::new(provider),
        }
    }
}

impl fmt::Debug for DynamicRateLimitPathRule {
    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
        formatter
            .debug_struct("DynamicRateLimitPathRule")
            .field("path", &self.path)
            .field("provider", &"<request-aware>")
            .finish()
    }
}

/// Rate limit storage record.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RateLimitRecord {
    pub key: String,
    pub count: u64,
    pub last_request: i64,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RateLimitConsumeInput {
    pub key: String,
    pub rule: RateLimitRule,
    /// Current time as Unix epoch **milliseconds**.
    pub now_ms: i64,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RateLimitDecision {
    pub permitted: bool,
    /// Seconds until the client may retry when `permitted` is false.
    pub retry_after: u64,
    pub limit: u64,
    pub remaining: u64,
    pub reset_after: u64,
}

pub type RateLimitFuture<'a> =
    Pin<Box<dyn Future<Output = Result<RateLimitDecision, RustAuthError>> + Send + 'a>>;

/// Atomic rate limit storage contract.
///
/// Implementations must make the check-and-increment decision in one atomic
/// operation when used for cross-process or distributed enforcement.
pub trait RateLimitStore: Send + Sync + 'static {
    fn consume<'a>(&'a self, input: RateLimitConsumeInput) -> RateLimitFuture<'a>;
}

/// Synchronous storage contract for router-level rate limiting.
///
/// This legacy contract is preserved for compatibility. It is not atomic across
/// multiple processes unless the implementation makes `get`/`set` externally
/// serializable.
pub trait RateLimitStorage: Send + Sync + 'static {
    fn get(&self, key: &str) -> Result<Option<RateLimitRecord>, RustAuthError>;
    fn set(
        &self,
        key: &str,
        value: RateLimitRecord,
        ttl_seconds: u64,
        update: bool,
    ) -> Result<(), RustAuthError>;
}

/// Rate limit storage selector.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum RateLimitStorageOption {
    Memory,
    Database,
    SecondaryStorage,
}

/// Policy applied when rate limiting is enabled but no client IP can be
/// resolved for a request.
///
/// This guards against a production deployment that enables rate limiting but
/// fails to inject [`RequestClientIp`](crate::rate_limit::RequestClientIp) or
/// configure a trusted IP header, which would otherwise silently disable
/// rate limiting on auth endpoints. The policy is only applied when IP
/// tracking is enabled; if `advanced.ip_address.disable_ip_tracking` is set,
/// per-IP limiting is intentionally skipped.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum MissingIpPolicy {
    /// Reject the request (fail closed). Secure default.
    #[default]
    Deny,
    /// Rate limit every IP-less request together under a shared anonymous
    /// bucket instead of a per-IP bucket.
    SharedBucket,
    /// Skip rate limiting when no client IP can be resolved (legacy fail-open).
    Allow,
}