namespace ErsatzTV.Core.Scheduling.ScriptedScheduling;

/// <summary>
///     The credential a scripted-playout program presents when it calls back into
///     <c>/api/v1/scripted/playout/build/{buildId}</c> (ersatztv#913, decision
///     <c>api.scripted-build-token</c>). <see cref="ScriptedPlayoutBuilder" /> mints one per build, hands it to
///     the program in <see cref="EnvironmentVariable" />, and the global API authorization filter accepts it in
///     <see cref="HeaderName" /> — for that build's endpoints only, and only while the build is running.
/// </summary>
public static class ScriptedBuildToken
{
    /// <summary>
    ///     The request header the program sends the token in. A custom header, so — like the machine
    ///     <c>X-Api-Key</c> — a browser cannot attach it cross-origin, and a token-authenticated mutation needs
    ///     no CSRF header.
    /// </summary>
    public const string HeaderName = "X-Scripted-Build-Token";

    /// <summary>
    ///     The environment variable the token is delivered in. Not a command-line argument: the argument list is
    ///     logged at Information level and is visible to every local user through the process table, and a new
    ///     positional argument would shift the user's own arguments (the ones after <c>mode</c>) by one.
    /// </summary>
    public const string EnvironmentVariable = "ETV_SCRIPTED_BUILD_TOKEN";
}