//! HashiCorp Vault configuration for secure secret management.

//!

//! This module provides configuration structures for integrating with HashiCorp Vault

//! to securely manage secrets, API keys, and sensitive configuration data in the

//! Foxhunt trading system. Supports token-based authentication and namespace isolation.

use serde::{Deserialize, Serialize};

use secrecy::{ExposeSecret, SecretString};

use std::fmt;

/// HashiCorp Vault configuration for secure secret storage.

///

/// Configures connection to HashiCorp Vault for retrieving sensitive

/// configuration data such as API keys, database passwords, and other

/// secrets. Supports Vault Enterprise features like namespaces.

///

/// # Security

///

/// The Vault token is wrapped in `SecretString` to prevent accidental

/// exposure in logs, debug output, or memory dumps. The token is automatically

/// zeroized when the config is dropped.

#[derive(Clone, Serialize, Deserialize)]

pub struct VaultConfig {

    /// Vault server URL (e.g., "<https://vault.example.com:8200>")

    pub url: String,

    /// Vault authentication token for API access (securely stored)

    #[serde(serialize_with = "serialize_secret", deserialize_with = "deserialize_secret")]

    pub token: SecretString,

    /// Mount path for the secrets engine (e.g., "secret/")

    pub mount_path: String,

    /// Vault namespace for multi-tenant deployments (Enterprise feature)

    pub namespace: Option<String>,

}

/// Custom serializer for SecretString that prevents token exposure

fn serialize_secret<S>(_secret: &SecretString, serializer: S) -> Result<S::Ok, S::Error>

where

    S: serde::Serializer,

{

    // Serialize as redacted placeholder to prevent token exposure

    serializer.serialize_str("***REDACTED***")

}

/// Custom deserializer for SecretString

fn deserialize_secret<'de, D>(deserializer: D) -> Result<SecretString, D::Error>

where

    D: serde::Deserializer<'de>,

{

    let s = String::deserialize(deserializer)
?0
;

    Ok(SecretString::from(s))

}

impl fmt::Debug for VaultConfig {

    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {

        f.debug_struct("VaultConfig")

            .field("url", &self.url)

            .field("token", &"***REDACTED***")

            .field("mount_path", &self.mount_path)

            .field("namespace", &self.namespace)

            .finish()

    }

}

impl Drop for VaultConfig {

    fn drop(&mut self) {

        // Explicitly zeroize the token when VaultConfig is dropped

        // This ensures the secret is cleared from memory

        // Note: SecretString already implements ZeroizeOnDrop, but we make it explicit

        // for documentation purposes

    }

}

impl VaultConfig {

    /// Creates a new VaultConfig with the specified parameters.

    ///

    /// # Security

    ///

    /// The token is immediately wrapped in a `SecretString` to prevent exposure.

    /// Consider using `from_env()` or loading from secure configuration

    /// sources instead of passing plain strings.

    pub fn new(url: String, token: String, mount_path: String) -> Self {

        Self {

            url,

            token: SecretString::from(token),

            mount_path,

            namespace: None,

        }

    }

    /// Sets the namespace for multi-tenant Vault deployments.

    pub fn with_namespace(mut self, namespace: String) -> Self {

        self.namespace = Some(namespace);

        self

    }

    /// Gets a reference to the secret token (requires explicit exposure)

    ///

    /// # Security

    ///

    /// This method requires the caller to explicitly acknowledge they are

    /// exposing the secret. Use only when necessary (e.g., when making

    /// API calls to Vault) and ensure the exposed value is not logged

    /// or stored in insecure locations.

    pub fn token(&self) -> &SecretString {

        &self.token

    }

    /// Validates the vault configuration.

    ///

    /// # Security

    ///

    /// Validation checks length without exposing the token value.

    pub fn validate(&self) -> Result<(), String> {

        if self.url.is_empty() {

            return Err("Vault URL cannot be empty".to_string());

        }

        if self.token.expose_secret().is_empty() {

            return Err("Vault token cannot be empty".to_string());

        }

        if self.mount_path.is_empty() {

            return Err("Vault mount path cannot be empty".to_string());

        }

        Ok(())

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    fn create_test_config() -> VaultConfig {

        VaultConfig::new(

            "https://vault.example.com:8200".to_string(),

            "test-token-12345".to_string(),

            "secret/".to_string(),

        )

    }

    #[test]

    fn test_vault_config_creation() {

        let config = create_test_config();

        assert_eq!(config.url, "https://vault.example.com:8200");

        assert_eq!(config.mount_path, "secret/");

        assert!(config.namespace.is_none());

    }

    #[test]

    fn test_vault_config_with_namespace() {

        let config = create_test_config().with_namespace("production".to_string());

        assert_eq!(config.namespace.as_deref(), Some("production"));

    }

    #[test]

    fn test_vault_config_validation_success() {

        let config = create_test_config();

        assert!(config.validate().is_ok());

    }

    #[test]

    fn test_vault_config_validation_empty_url() {

        let mut config = create_test_config();

        config.url = String::new();

        assert!(config.validate().is_err());

        assert_eq!(config.validate().unwrap_err(), "Vault URL cannot be empty");

    }

    #[test]

    fn test_vault_config_validation_empty_token() {

        let mut config = create_test_config();

        config.token = SecretString::from(String::new());

        assert!(config.validate().is_err());

        assert_eq!(

            config.validate().unwrap_err(),

            "Vault token cannot be empty"

        );

    }

    #[test]

    fn test_vault_config_validation_empty_mount_path() {

        let mut config = create_test_config();

        config.mount_path = String::new();

        assert!(config.validate().is_err());

        assert_eq!(

            config.validate().unwrap_err(),

            "Vault mount path cannot be empty"

        );

    }

    #[test]

    fn test_vault_config_serialization() {

        let config = create_test_config();

        let serialized = serde_json::to_string(&config).unwrap();

        // Token should be redacted in serialization

        assert!(serialized.contains("***REDACTED***"));

        assert!(!serialized.contains("test-token-12345"));

    }

    #[test]

    fn test_vault_config_deserialization() {

        let config = create_test_config();

        let serialized = serde_json::to_string(&config).unwrap();

        let deserialized: VaultConfig = serde_json::from_str(&serialized).unwrap();

        assert_eq!(config.url, deserialized.url);

        assert_eq!(config.mount_path, deserialized.mount_path);

    }

    #[test]

    fn test_vault_config_clone() {

        let config1 = create_test_config();

        let config2 = config1.clone();

        assert_eq!(config1.url, config2.url);

    }

    #[test]

    fn test_vault_config_debug() {

        let config = create_test_config();

        let debug_output = format!("{:?}", config);

        assert!(debug_output.contains("VaultConfig"));

        assert!(debug_output.contains("***REDACTED***"));

        assert!(!debug_output.contains("test-token-12345"));

    }

    #[test]

    fn test_vault_config_namespace_none() {

        let config = create_test_config();

        assert!(config.namespace.is_none());

    }

    #[test]

    fn test_vault_config_namespace_some() {

        let config = create_test_config().with_namespace("dev".to_string());

        assert!(config.namespace.is_some());

        assert_eq!(config.namespace.as_deref(), Some("dev"));

    }

    #[test]

    fn test_vault_config_token_not_exposed() {

        let config = create_test_config();

        // Verify token accessor works

        assert_eq!(config.token().expose_secret(), "test-token-12345");

    }

    #[test]

    fn test_vault_config_token_redacted_in_display() {

        let config = create_test_config();

        let debug_str = format!("{:?}", config);

        assert!(!debug_str.contains("test-token-12345"));

    }

}