<?php
declare(strict_types=1);

/** WG client IPs + server AllowedIPs from config (matches live wg0 on BE). */
final class WireGuardAddressPool {
    private function __construct() {
    }

    public static function defaultEndpoint(): string {
        return (string) cfg('remote_access.wg_endpoint', 'ra.apps.f0xx.org:45340');
    }

    public static function serverAllowedIps(): string {
        return (string) cfg('remote_access.wg_server_allowed_ips', '172.200.2.1/32');
    }

    public static function allocateClientAddress(string $sessionId): string {
        $prefix = (string) cfg('remote_access.wg_client_ip_prefix', '172.200.2.');
        $min = max(2, (int) cfg('remote_access.wg_client_ip_min', 10));
        $max = max($min, (int) cfg('remote_access.wg_client_ip_max', 250));
        $span = $max - $min + 1;
        $host = $min + (abs(crc32($sessionId)) % $span);
        return $prefix . $host . '/32';
    }
}
