package com.hiveops.aria.controller;

import com.hiveops.aria.dto.ThreatEventIngestionRequest;
import com.hiveops.aria.service.ThreatEventIngestionService;
import jakarta.validation.Valid;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/aria/ingest")
@RequiredArgsConstructor
@Slf4j
public class ThreatEventIngestionController {

    private final ThreatEventIngestionService ingestionService;

    @Value("${aria.internal.service-secret:}")
    private String serviceSecret;

    @PostMapping("/events")
    public ResponseEntity<Void> ingestEvents(
            @RequestHeader(value = "X-Service-Secret", required = false) String secret,
            @Valid @RequestBody ThreatEventIngestionRequest request) {

        if (!serviceSecret.isBlank() && !serviceSecret.equals(secret)) {
            log.warn("Rejected ingestion request from {} — invalid service secret", request.getDeviceAgentId());
            return ResponseEntity.status(401).build();
        }

        ingestionService.ingest(request);
        return ResponseEntity.accepted().build();
    }
}
