//! Break-Glass Emergency Access System
//!
//! Provides controlled emergency access with multi-party approval, automatic
//! revocation, and comprehensive audit logging. This system is designed for
//! genuine emergencies only (production outages, security incidents).
//!
//! ## Features
//!
//! - **Multi-party approval**: Requires 2+ approvers from different teams
//! - **Time-limited sessions**: Maximum 4 hours, auto-revoke on expiration
//! - **Inactivity timeout**: Auto-revoke after 30 minutes of inactivity
//! - **Enhanced audit logging**: 7-year retention, immutable records
//! - **Real-time alerts**: Security team notified immediately
//! - **Cedar policy bypass**: Emergency sessions have elevated permissions
//! - **Automatic revocation**: Background monitoring and cleanup

pub mod api;
pub mod approval;
pub mod revocation;
pub mod session;
pub mod types;

use std::sync::Arc;

use anyhow::Result;
pub use api::*;
pub use approval::*;
pub use revocation::*;
pub use session::*;
use tracing::info;
pub use types::*;

/// Break-glass service orchestrator
pub struct BreakGlassService {
    /// Session manager
    session_manager: Arc<SessionManager>,

    /// Approval manager
    approval_manager: Arc<ApprovalManager>,

    /// Auto-revocation monitor
    revocation_monitor: Arc<RevocationMonitor>,

    /// Configuration
    config: BreakGlassConfig,
}

impl BreakGlassService {
    /// Create new break-glass service
    pub fn new(config: BreakGlassConfig) -> Self {
        let session_manager = Arc::new(SessionManager::new(config.clone()));
        let approval_manager = Arc::new(ApprovalManager::new(config.approval_config.clone()));
        let revocation_monitor = Arc::new(RevocationMonitor::new(
            Arc::clone(&session_manager),
            config.auto_revoke_config.clone(),
        ));

        Self {
            session_manager,
            approval_manager,
            revocation_monitor,
            config,
        }
    }

    /// Start background monitoring tasks
    pub async fn start(&self) -> Result<()> {
        info!("Starting break-glass service");

        // Start auto-revocation monitor
        self.revocation_monitor.start_monitoring().await;

        info!("Break-glass service started successfully");
        Ok(())
    }

    /// Get session manager
    pub fn session_manager(&self) -> Arc<SessionManager> {
        Arc::clone(&self.session_manager)
    }

    /// Get approval manager
    pub fn approval_manager(&self) -> Arc<ApprovalManager> {
        Arc::clone(&self.approval_manager)
    }

    /// Get revocation monitor
    pub fn revocation_monitor(&self) -> Arc<RevocationMonitor> {
        Arc::clone(&self.revocation_monitor)
    }

    /// Get configuration
    pub fn config(&self) -> &BreakGlassConfig {
        &self.config
    }

    /// Shutdown service
    pub async fn shutdown(&self) -> Result<()> {
        info!("Shutting down break-glass service");
        self.revocation_monitor.shutdown().await;
        info!("Break-glass service shutdown complete");
        Ok(())
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[tokio::test]
    async fn test_break_glass_service_creation() {
        let config = BreakGlassConfig::default();
        let service = BreakGlassService::new(config);
        assert!(service.start().await.is_ok());
    }
}
