import rateLimit from 'express-rate-limit';

/**
 * General rate limiter — applied globally to all API routes.
 * Configurable via environment variables.
 */
export const rateLimiter = rateLimit({
  windowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || '900000', 10), // 15 minutes
  max: parseInt(process.env.RATE_LIMIT_MAX_REQUESTS || '5000', 10),
  message: {
    success: false,
    message: 'Too many requests from this IP, please try again later.',
    timestamp: new Date(),
  },
  standardHeaders: true,
  legacyHeaders: false,
  skip: (req) => req.path === '/health' || req.path === '/api/v1/health',
});

/**
 * Stricter rate limiter for authentication routes (login, token exchange).
 * Prevents brute-force attacks on auth endpoints.
 */
export const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 200,
  message: {
    success: false,
    message: 'Too many authentication attempts. Please try again later.',
    timestamp: new Date(),
  },
  standardHeaders: true,
  legacyHeaders: false,
});

/**
 * Rate limiter for file upload routes.
 * Prevents upload abuse / DoS.
 */
export const uploadLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 500,
  message: {
    success: false,
    message: 'Too many upload requests. Please try again later.',
    timestamp: new Date(),
  },
  standardHeaders: true,
  legacyHeaders: false,
});

/**
 * Rate limiter for admin routes.
 * Stricter to prevent admin action abuse.
 */
export const adminLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 300,
  message: {
    success: false,
    message: 'Too many admin requests. Please try again later.',
    timestamp: new Date(),
  },
  standardHeaders: true,
  legacyHeaders: false,
});

/**
 * Rate limiter for SAP / PWC e-invoice integration routes.
 * Very strict — SAP and PWC calls are expensive external API calls.
 */
export const sapLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  message: {
    success: false,
    message: 'Too many SAP/e-invoice requests. Please wait before trying again.',
    timestamp: new Date(),
  },
  standardHeaders: true,
  legacyHeaders: false,
});

/**
 * Rate limiter for AI routes.
 * AI calls are resource-intensive — limit accordingly.
 */
export const aiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 200,
  message: {
    success: false,
    message: 'Too many AI requests. Please try again later.',
    timestamp: new Date(),
  },
  standardHeaders: true,
  legacyHeaders: false,
});

/**
 * Rate limiter for DMS webhook routes.
 * Webhooks may come in bursts, allow higher throughput.
 */
export const webhookLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 1000,
  message: {
    success: false,
    message: 'Too many webhook requests. Please try again later.',
    timestamp: new Date(),
  },
  standardHeaders: true,
  legacyHeaders: false,
});

/**
 * General API rate limiter for standard routes.
 * Applied to routes without a more specific limiter.
 */
export const generalApiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 2000,
  message: {
    success: false,
    message: 'Too many requests. Please try again later.',
    timestamp: new Date(),
  },
  standardHeaders: true,
  legacyHeaders: false,
});
