const forbiddenConfigName = /(SECRET|PASSWORD|PRIVATE_KEY|TOKEN)/i;

export const ENV_REGISTRY = Object.freeze({
  VITE_BUILD_ID: build("public-metadata", true, null),
  VITE_COMMIT_SHA: build("public-metadata", false, "local"),
  VITE_ROUTER_BASE_PATH: build("compile-time", true, "/"),
  VITE_RUNTIME_CONFIG_URL: build("compile-time", true, "/config.json"),
  APP_ENV: runtime("public", true, null),
  API_BASE_URL: runtime("public-sensitive", true, null),
  REQUEST_TIMEOUT_MS: runtime("public", false, 10_000),
  MAX_RETRY_ATTEMPTS: runtime("public", false, 2),
  TELEMETRY_ENABLED: runtime("public", true, false),
  TELEMETRY_ENDPOINT: runtime("public-sensitive", false, null),
  AUTH_MODE: runtime("public", true, "external"),
  CONFIG_SCHEMA_VERSION: runtime("public", true, null),
  API_CONTRACT_VERSION: runtime("public", true, null),
  RELEASE_MANIFEST_URL: runtime("public", true, "/release-manifest.json"),
});

/**
 * @param {string} classification
 * @param {boolean} required
 * @param {unknown} defaultValue
 */
function build(classification, required, defaultValue) {
  return Object.freeze({ phase: "build", classification, required, defaultValue });
}

/**
 * @param {string} classification
 * @param {boolean} required
 * @param {unknown} defaultValue
 */
function runtime(classification, required, defaultValue) {
  return Object.freeze({ phase: "runtime", classification, required, defaultValue });
}

/** @param {Record<string, unknown>} config */
export function assertSafeConfigNames(config) {
  for (const name of Object.keys(config)) {
    if (forbiddenConfigName.test(name)) {
      throw new Error(`Forbidden client configuration key: ${name}`);
    }
  }
}

export function getBuildConfig(environment = import.meta.env) {
  const buildId = environment.VITE_BUILD_ID || "local-build";
  const commitSha = environment.VITE_COMMIT_SHA || "local";
  const routerBasePath = environment.VITE_ROUTER_BASE_PATH || "/";
  const runtimeConfigUrl = environment.VITE_RUNTIME_CONFIG_URL || "/config.json";

  return Object.freeze({ buildId, commitSha, routerBasePath, runtimeConfigUrl });
}