using System.Security.Cryptography;
using General_Ledger_Service.DTOs.Common;
using General_Ledger_Service.Exceptions;
using General_Ledger_Service.Interfaces.Services;

namespace General_Ledger_Service.Services
{
    // Dev-only bootstrap tool: generates the shared secret ApiKeyMiddleware checks. Never
    // callable outside Development, no matter what - production has no way to reach this branch.
    // The generated key is only returned, never persisted - it still has to be copied into
    // appsettings.*.json (this service) and the core backend's matching config by hand.
    public class DevToolsService(IHostEnvironment hostEnvironment) : IDevToolsService
    {
        private readonly IHostEnvironment _hostEnvironment = hostEnvironment;

        public ApiResponse GenerateApiKey()
        {
            if (!_hostEnvironment.IsDevelopment())
            {
                throw new ForbiddenException("This endpoint is only available in the Development environment");
            }

            var apiKey = Convert.ToHexString(RandomNumberGenerator.GetBytes(32));

            return ResponseHelpers.Ok(
                "API key generated. Copy this into ApiKey:Value in appsettings.Development.json (and appsettings.Production.json / the deploy-time secret store, plus the core backend's matching config) - it is not saved anywhere by this call.",
                new { apiKey });
        }
    }
}