namespace Meezi.API.Security;

public class AbuseProtectionOptions
{
    public const string SectionName = "Security";

    public bool Enabled { get; set; } = true;

    /// <summary>When true, public write endpoints require a valid Turnstile token if SecretKey is set.</summary>
    public bool RequireCaptchaOnPublicWrites { get; set; }

    public TurnstileOptions Turnstile { get; set; } = new();

    public RateLimitOptions RateLimits { get; set; } = new();

    public GuestOrderLimits GuestOrders { get; set; } = new();
}

public class TurnstileOptions
{
    public string SiteKey { get; set; } = "";
    public string SecretKey { get; set; } = "";
}

public class RateLimitOptions
{
    public int AuthOtpPerIpPerHour { get; set; } = 15;
    public int PublicReadsPerIpPerMinute { get; set; } = 120;
    public int PublicWritesPerIpPerMinute { get; set; } = 30;
}

public class GuestOrderLimits
{
    public int PerIpPerCafePerHour { get; set; } = 25;
    public int PerCafePerHour { get; set; } = 200;
    public int PerIpGlobalPerHour { get; set; } = 60;
}
