package config

import (
	"errors"
	"fmt"
	"os"
)

const (
	EnvJWTSecret             = "JWT_SECRET"
	MinJWTSecretBytes        = 32
	EnvSmtpAllowInsecure     = "SMTP_ALLOW_INSECURE"
	DefaultSmtpAllowInsecure = "false"
)

var ErrWeakJWTSecret = errors.New("JWT_SECRET is too weak")

var placeholderJWTSecrets = map[string]bool{
	"change-me-to-a-long-random-string":          true,
	"replace-with-output-of-openssl-rand-hex-32": true,
}

func ValidateJWTSecret(secret string) error {
	if placeholderJWTSecrets[secret] {
		return fmt.Errorf("%w: it is still the example value; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret)
	}
	if len(secret) < MinJWTSecretBytes {
		return fmt.Errorf("%w: it must be at least %d bytes long; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret, MinJWTSecretBytes)
	}
	return nil
}

func jwtSecretFromEnv() (string, error) {
	secret := os.Getenv(EnvJWTSecret)
	if err := ValidateJWTSecret(secret); err != nil {
		return "", err
	}
	return secret, nil
}