// CSM (csm.vuphong.vn) directory + auth-delegation consumer config.
// This whole integration is GATED: it is only active when both env vars are set.
// When disabled, AOM keeps its local users + local login untouched (cold fallback).
//
// NOTE: This is the OUTBOUND consumer key (AOM -> CSM). Do not confuse with
// CSM_SERVICE_TOKEN, which is the INBOUND data-sync token (CSM -> AOM).

export function isCsmEnabled(): boolean {
  return !!(process.env.CSM_API_BASE_URL && process.env.CSM_INTEGRATION_KEY);
}

export const CSM = {
  /** e.g. https://csm.vuphong.vn/api/integrations (no trailing slash) */
  baseUrl(): string {
    return (process.env.CSM_API_BASE_URL || '').replace(/\/+$/, '');
  },
  key(): string {
    return process.env.CSM_INTEGRATION_KEY || '';
  },
  /**
   * Optional Host header override. Lets us hit CSM over loopback
   * (http://localhost:8001) while still presenting Host: csm.vuphong.vn, which
   * CSM's integration guard requires to accept a plaintext loopback request
   * (fromTrustedTlsProxy). Avoids the flaky public-domain hairpin round-trip.
   */
  hostHeader(): string {
    return (process.env.CSM_HOST_HEADER || '').trim();
  },
  /** Server-to-server request timeout (ms). Short on purpose. */
  timeoutMs(): number {
    return parseInt(process.env.CSM_TIMEOUT_MS || '8000', 10);
  },
  /** In-memory directory cache TTL (ms). RAM only, no DB. */
  dirCacheMs(): number {
    return parseInt(process.env.CSM_DIR_CACHE_MS || '45000', 10);
  },
};