package cmd

import (
	"github.com/spf13/pflag"
)

var (
	fTLSClient = pflag.NewFlagSet("tlsclient", pflag.ExitOnError)
	fTLSServer = pflag.NewFlagSet("tlsserver", pflag.ExitOnError)
	fProfiler  = pflag.NewFlagSet("profile", pflag.ExitOnError)
	fHealth    = pflag.NewFlagSet("health", pflag.ExitOnError)
	fPolicer   = pflag.NewFlagSet("policer", pflag.ExitOnError)
	fCORS      = pflag.NewFlagSet("cors", pflag.ExitOnError)
	fAgentAuth = pflag.NewFlagSet("agentauth", pflag.ExitOnError)
	fSBOM      = pflag.NewFlagSet("sbom", pflag.ExitOnError)
	fMCP       = pflag.NewFlagSet("mcp", pflag.ExitOnError)

	initialized = false
)

func initSharedFlagSet() {

	if initialized {
		return
	}

	initialized = true

	fTLSServer.StringP("tls-server-cert", "c", "", "path to the server certificate for incoming HTTPS connections.")
	fTLSServer.StringP("tls-server-key", "k", "", "path to the key for the server certificate.")
	fTLSServer.StringP("tls-server-key-pass", "p", "", "passphrase for the server certificate key.")
	fTLSServer.String("tls-server-client-ca", "", "path to a CA to require and validate incoming client certificates.")

	fTLSClient.StringP("tls-client-cert", "C", "", "path to the client certificate to authenticate against the minibridge backend.")
	fTLSClient.StringP("tls-client-key", "K", "", "path to the key for the client certificate.")
	fTLSClient.StringP("tls-client-key-pass", "P", "", "passphrase for the client certificate key.")
	fTLSClient.String("tls-client-backend-ca", "", "path to a CA to validate the minibridge backend server certificates.")
	fTLSClient.Bool("tls-client-insecure-skip-verify", false, "skip backend's server certificates validation. INSECURE.")

	fHealth.String("health-listen", "", "if set, start health server on that address.")

	fPolicer.StringP("policer-type", "P", "", "type of policer to use. 'rego' or 'http'.")
	fPolicer.Bool("policer-enforce", true, "enforce policy or only log verdict.")
	fPolicer.String("policer-rego-policy", "", "path to a rego policy file for the rego policer.")
	fPolicer.String("policer-http-url", "", "URL of the HTTP policer to POST agent policing requests.")
	fPolicer.String("policer-http-bearer-token", "", "token to use to authenticate against the HTTP policer using Bearer scheme.")
	fPolicer.String("policer-http-basic-user", "", "user to use to authenticate against the HTTP policer using Basic scheme.")
	fPolicer.String("policer-http-basic-pass", "", "password to use to authenticate against the HTTP policer using Basic scheme.")
	fPolicer.String("policer-http-ca", "", "path to a CA to validate the policer server certificates.")
	fPolicer.Bool("policer-http-insecure-skip-verify", false, "skip policer's server certificates validation. INSECURE.")

	fCORS.String("cors-origin", "*", "sets the valid HTTP Origin for CORS responses.")

	fAgentAuth.StringP("agent-token", "t", "", "JWT token to pass to the minibridge backend for agent identification.")
	fAgentAuth.String("agent-user", "", "User to send to the backend as Basic auth.")
	fAgentAuth.String("agent-pass", "", "Password to send to the backend as Basic auth.")
	fAgentAuth.Bool("oauth-disabled", false, "If set, skip trying to perform the oauth dance.")

	fSBOM.String("sbom", "", "path to a sbom file (generated by minibridge scan sbom) to ensure server integrity.")

	fMCP.Int("mcp-uid", -1, "if greater than -1, use as UID to run the MCP server command.")
	fMCP.Int("mcp-gid", -1, "if greater than -1, use as GID to run the MCP server command.")
	fMCP.IntSlice("mcp-groups", nil, "additional GIDs to to run the MCP server command.")
	fMCP.Bool("mcp-use-tempdir", false, "if set, create a new temp execution dir for each MCP server instance.")
	fMCP.String("mcp-tls-ca", "", "when using SSE, path to a CA to valide MCP server server certificates.")
	fMCP.Bool("mcp-tls-insecure-skip-verify", false, "skip MCP server certificates validation. INSECURE.")
}
