<?php
declare(strict_types=1);
namespace App\Api;

use App\Config;
use App\Http\{Request, Response};
use App\Security\Hmac;
use App\Repository\{DeviceRepository, ZoneRepository, ThresholdRepository, NonceRepository, RateLimiterRepository};

final class ConfigController
{
    public function __construct(
        private DeviceRepository $devices, private ZoneRepository $zones, private ThresholdRepository $thresholds,
        private NonceRepository $nonces, private Config $cfg,
        private ?RateLimiterRepository $rateLimiter = null,
    ) {}

    public function get(Request $req, int $now, string $clientIp = ''): Response
    {
        // Pre-auth per-IP anti-flood, like /api/events — HMAC + DB reads on every hit.
        if ($this->rateLimiter !== null && $clientIp !== ''
            && $this->rateLimiter->hit('ip:' . $clientIp, intdiv($now, 60)) > $this->cfg->ingestIpRateLimitPerMin()) {
            return Response::json(['error' => 'rate_limited'], 429);
        }
        $deviceId = (string)$req->query('device_id');
        $secret = $deviceId !== '' ? $this->devices->secretFor($deviceId) : null;
        $nonce = $req->header('X-Nonce') ?? ''; $ts = $req->header('X-Timestamp') ?? ''; $sig = $req->header('X-Signature') ?? '';
        if ($secret === null || !Hmac::verify($secret, $nonce, $ts, $req->body(), $sig)) {
            return Response::json(['error' => 'unauthorized'], 401);
        }
        if (abs($now - (int)(float)$ts) > $this->cfg->timestampWindow()) {
            return Response::json(['error' => 'stale'], 401);
        }
        if ($nonce === '' || $this->nonces->seen($nonce)) {
            return Response::json(['error' => 'replay'], 401);
        }
        $this->nonces->remember($nonce, $now + $this->cfg->nonceTtl());

        return Response::json([
            'version' => $this->devices->configVersion($deviceId),
            'zones' => $this->zones->forDevice($deviceId),
            'thresholds' => $this->thresholds->forDevice($deviceId),
        ], 200);
    }
}