use serde::Deserialize;

/// 滥用检测 / 自动封禁 / 告警配置
#[derive(Debug, Deserialize, Clone)]
pub struct AbuseConfig {
    /// 单发件域 10 分钟邮件数阈值（超阈值自动临时封禁）
    #[serde(default = "default_domain_emails_threshold_10min")]
    pub domain_emails_threshold_10min: i64,
    /// 单 IP 每分钟连接数阈值
    #[serde(default = "default_ip_connects_threshold_1min")]
    pub ip_connects_threshold_1min: i64,
    /// 自动封禁 TTL（秒）
    #[serde(default = "default_auto_block_ttl_seconds")]
    pub auto_block_ttl_seconds: i64,
    /// 蜜罐地址列表
    #[serde(default = "default_honeypot_addresses")]
    pub honeypot_addresses: Vec<String>,
    /// 告警 webhook（留空则只写 audit_logs / abuse_events）
    #[serde(default)]
    pub alert_webhook_url: String,
}

fn default_domain_emails_threshold_10min() -> i64 {
    50
}
fn default_ip_connects_threshold_1min() -> i64 {
    60
}
fn default_auto_block_ttl_seconds() -> i64 {
    3600
}
fn default_honeypot_addresses() -> Vec<String> {
    vec![
        "admin@mail.shenjianl.cn".into(),
        "noreply@mail.shenjianl.cn".into(),
        "test@mail.shenjianl.cn".into(),
    ]
}

impl Default for AbuseConfig {
    fn default() -> Self {
        Self {
            domain_emails_threshold_10min: default_domain_emails_threshold_10min(),
            ip_connects_threshold_1min: default_ip_connects_threshold_1min(),
            auto_block_ttl_seconds: default_auto_block_ttl_seconds(),
            honeypot_addresses: default_honeypot_addresses(),
            alert_webhook_url: String::new(),
        }
    }
}
