namespace SQLInsight.Web;

public sealed class WebOptions
{
    public const string SectionName = "SQLInsight:Web";

    /// <summary>Windows (Negotiate/Kerberos) or None. None is for development only.</summary>
    public string Authentication { get; set; } = "Windows";

    /// <summary>Windows groups allowed to use the UI (e.g. DOMAIN\SQL-Admins). Empty: any authenticated user.</summary>
    public IList<string> AllowedGroups { get; } = [];

    /// <summary>Time zone for display, e.g. Europe/Copenhagen. Defaults to the server's local time zone.</summary>
    public string? TimeZone { get; set; }

    /// <summary>
    /// Tokens for /api/ and /metrics (name → "sha256:&lt;hex&gt;"). Create one with <c>SQLInsight.Web new-api-token &lt;name&gt;</c>.
    /// </summary>
    public IDictionary<string, string> ApiTokens { get; } = new Dictionary<string, string>();

    /// <summary>Include evidence marked sensitive (query text, logins, host names) in /api/v1/findings. Off by default.</summary>
    public bool ApiIncludesSensitiveEvidence { get; set; }
}