const DEFAULT_RPM = 120;

// JSON body ceiling for the LLM wire surfaces (/v1, /v1beta, /mcp, Ollama
// /api/*). Vision requests inline base64 images (~33% inflation over the raw
// bytes; google.ts alone forwards images up to 8MB, ~10.7MB in base64), so a
// single-screenshot Codex turn easily clears 10MB, and history replay stacks
// several of them (an 11.85MB real-world request was observed). express.json
// buffers the whole body in memory (2-3x transiently during the parse), so
// this also bounds the per-request spike on small containers. Anything past
// the ceiling 413s before routing — no fallback, no analytics row — so it
// must sit above the largest payload we expect to serve. 25MB is the balance
// point: it clears the observed 11.85MB replayed session with room to spare,
// while keeping the worst case survivable on the small hosts this runs on (a
// Pi or a 512MB VPS — the limit is PER REQUEST, so a handful of concurrent
// maximal bodies is the number that actually has to fit in RAM). Inbound
// image normalization shrinks payloads ~6-10x right after the parse, so the
// steady state sits far below this. Raise REQUEST_BODY_LIMIT_MB on a bigger
// box if a client genuinely sends more. The dashboard/admin surface keeps its
// own smaller fixed ceiling.
const DEFAULT_REQUEST_BODY_LIMIT_MB = 25;

function parseRateLimitRpm(): number {
  const raw = process.env.PROXY_RATE_LIMIT_RPM;
  if (raw === undefined || raw.trim() === '') return DEFAULT_RPM;
  const n = Number(raw);
  if (!Number.isFinite(n) || n < 0) return DEFAULT_RPM;
  return Math.floor(n);
}

function parseRequestBodyLimitBytes(): number {
  const raw = process.env.REQUEST_BODY_LIMIT_MB;
  if (raw === undefined || raw.trim() === '') return DEFAULT_REQUEST_BODY_LIMIT_MB * 1024 * 1024;
  const n = Number(raw);
  if (!Number.isFinite(n) || n < 1) return DEFAULT_REQUEST_BODY_LIMIT_MB * 1024 * 1024;
  return Math.floor(n) * 1024 * 1024;
}

export interface Config {
  port: number | string;
  host: string;
  dbPath: string | null;
  dashboardOrigins: string[];
  clientDist: string | null;
  proxyRateLimitRpm: number;
  /** JSON body limit (bytes) for the LLM wire surfaces — see
   *  parseRequestBodyLimitBytes. REQUEST_BODY_LIMIT_MB overrides. */
  requestBodyLimitBytes: number;
  nodeEnv: string;
  serveStaticAssets: boolean;
  /**
   * Express `trust proxy` setting, parsed from TRUST_PROXY (#1024).
   * - false:        do not trust forwarded headers (default; direct callers
   *                 cannot spoof X-Forwarded-For).
   * - true:         trust all proxies (with a security warning).
   * - number:       trust that many hops counted from the socket peer
   *                 (Express's `trust proxy: 1` idiom for one proxy in front).
   * - string[]:     trust only these proxy addresses/CIDRs.
   */
  trustProxy: boolean | number | string[];
  /**
   * Tri-state override for the CSP `upgrade-insecure-requests` directive (#682).
   * - undefined: auto — emit the directive only when the request arrived over
   *   TLS (or behind an HTTPS reverse proxy that forwarded X-Forwarded-Proto).
   * - true:      always emit (force HTTPS upgrade even on plain HTTP).
   * - false:     never emit (let HTTP LAN installs render the dashboard).
   */
  cspUpgradeInsecureRequests: boolean | undefined;
}

export function loadConfig(): Config {
  return {
    port: process.env.PORT ?? 3001,
    // Dual-stack ('::') by default so the dashboard is reachable over both IPv4
    // and IPv6 (e.g. IPv6-enabled Docker networks — #180). Hosts with IPv6
    // disabled fall back to IPv4-only below; HOST overrides the default outright.
    host: process.env.HOST ?? '::',
    dbPath: process.env.FREEAPI_DB_PATH?.trim() || null,
    dashboardOrigins: (process.env.DASHBOARD_ORIGINS ?? '')
      .split(',')
      .map(s => s.trim())
      .filter(Boolean),
    clientDist: process.env.CLIENT_DIST ?? null,
    proxyRateLimitRpm: parseRateLimitRpm(),
    requestBodyLimitBytes: parseRequestBodyLimitBytes(),
    nodeEnv: process.env.NODE_ENV ?? 'development',
    serveStaticAssets: true,
    trustProxy: parseTrustProxy(),
    // CSP_UPGRADE_INSECURE_REQUESTS: true|false forces the directive on/off;
    // unset (the default) leaves it on auto — emit only when the request is
    // already TLS or forwarded as https, so HTTP LAN installs still render.
    cspUpgradeInsecureRequests: parseCspUpgradeInsecureRequests(),
  };
}

// Parse TRUST_PROXY (#1024). unset/empty/false → false (do not trust forwarded
// headers); true → trust all proxies; a non-negative integer → that many hops
// from the socket peer (so `TRUST_PROXY=1` means "one proxy in front", the
// Express idiom, not "trust everything"); otherwise a comma-separated list of
// proxy addresses/CIDRs → trust only those hops.
function parseTrustProxy(): boolean | number | string[] {
  const raw = process.env.TRUST_PROXY;
  if (raw === undefined || raw.trim() === '') return false;
  const lower = raw.trim().toLowerCase();
  if (lower === 'true' || lower === 'yes') return true;
  if (lower === 'false' || lower === 'no') return false;
  if (/^\d+$/.test(lower)) {
    const hops = Number(lower);
    return hops > 0 ? hops : false;
  }
  const addrs = raw.split(',').map(s => s.trim()).filter(Boolean);
  return addrs.length > 0 ? addrs : false;
}

function parseCspUpgradeInsecureRequests(): boolean | undefined {
  const raw = process.env.CSP_UPGRADE_INSECURE_REQUESTS;
  if (raw === undefined || raw.trim() === '') return undefined;
  const lower = raw.trim().toLowerCase();
  if (lower === 'true' || lower === '1' || lower === 'yes') return true;
  if (lower === 'false' || lower === '0' || lower === 'no') return false;
  return undefined;
}