import { z } from 'zod';

/**
 * Auditor T1D (2026-06-01): /api/notifications/test body validation.
 *
 * Route accepts SMTP / webhook test configs from ADMIN/EDITOR. Prior
 * code did `const { type, config } = await req.json()` with only an
 * existence check. With Zod, every field is type-bound and length-
 * bound before the SSRF guard (T1B) and nodemailer see it.
 *
 * Strings that flow into SMTP headers or email templates pass through
 * the project's existing `noControlChars` rule (mirrors
 * incident.schema.ts:6).
 */
const noControlChars = (val: string) => !/[\r\n\t\0]/.test(val);
const noControlCharsMsg = 'Control characters (CR, LF, tab, NUL) are not allowed';

export const smtpConfigSchema = z.object({
    smtpHost: z.string().min(1).max(253).refine(noControlChars, noControlCharsMsg),
    smtpPort: z.coerce.number().int().positive().max(65535),
    smtpUser: z.string().min(1).max(320).refine(noControlChars, noControlCharsMsg),
    smtpPass: z.string().min(1).max(512),
    fromEmail: z.string().max(320).refine(noControlChars, noControlCharsMsg).optional(),
    smtpIgnoreTls: z.union([z.boolean(), z.literal('true'), z.literal('false')]).optional(),
});

export const testNotificationSchema = z.object({
    type: z.enum(['email', 'smtp', 'webhook', 'slack', 'discord', 'pagerduty', 'telegram', 'teams']),
    config: smtpConfigSchema.passthrough(),
});

export type TestNotificationInput = z.infer<typeof testNotificationSchema>;