package com.atlassian.bitbucket.mesh.config;

import com.atlassian.bitbucket.mesh.annotation.ManagedByControlPlane;

import javax.annotation.Nonnull;
import java.time.Duration;

/**
 * Application configuration properties related to authenticating requests.
 */
public interface AuthenticationConfig {

    /**
     * @return the allowed clock skew, which is applied when validating whether a signed token has expired
     */
    @ManagedByControlPlane //AUTH_ALLOWED_CLOCK_SKEW
    @Nonnull
    Duration getAllowedClockSkew();

    /**
     * @return the expiry interval that should be applied when signing a token; a value less than or equal to
     *         zero indicates tokens should not expire (which is not recommended)
     */
    @ManagedByControlPlane //AUTH_EXPIRY_INTERVAL
    @Nonnull
    Duration getExpiryInterval();

    /**
     * @return the interval between logging warnings when authentication fails <i>for a given client</i>;
     *         intervals are tracked separately for each client (think control plane and individual nodes)
     */
    @Nonnull
    Duration getFailureLogInterval();

    /**
     * @return the minimum interval between attempts to request missing public key for a <i>for a given client</i>; from
     *         the control plane intervals are tracked separately for each client (think control plane and individual
     *         nodes)
     * @since 1.4
     */
    @Nonnull
    Duration getKeyRequestInterval();

    /**
     * @return {@code true} if inbound and outbound requests should be authenticated; otherwise, {@code false} if
     *         requests <i>in both directions</i> should be made without authentication
     */
    boolean isEnabled();

    /**
     * @return {@code true} if a positive {@link #getExpiryInterval} is defined; otherwise, {@code false}
     */
    boolean isExpiryEnabled();
}
