// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Script, console} from "forge-std/Script.sol";
import {SubmitRateLimitExtension} from "../../contracts/mainnet-checkpoint/extensions/SubmitRateLimitExtension.sol";
import {TimelockSubmitExtension} from "../../contracts/mainnet-checkpoint/extensions/TimelockSubmitExtension.sol";
import {ValidatorSigVerifierExtension} from "../../contracts/mainnet-checkpoint/extensions/ValidatorSigVerifierExtension.sol";
import {TokenTransferFilterExtension} from "../../contracts/mainnet-checkpoint/extensions/TokenTransferFilterExtension.sol";
import {ZkStateRootVerifierExtension} from "../../contracts/mainnet-checkpoint/extensions/ZkStateRootVerifierExtension.sol";
import {BlockHeaderOracleExtension} from "../../contracts/mainnet-checkpoint/extensions/BlockHeaderOracleExtension.sol";
import {MinPaymentValueExtension} from "../../contracts/mainnet-checkpoint/extensions/MinPaymentValueExtension.sol";

/// @notice Per-extension granular tuning from env (post-deploy).
contract ConfigureCheckpointExtensions is Script {
    function run() external {
        uint256 pk = vm.envUint("PRIVATE_KEY");
        vm.startBroadcast(pk);

        address rateLimit = vm.envOr("EXT_RATE_LIMIT", address(0));
        if (rateLimit != address(0)) {
            uint256 maxPerHour = vm.envOr("CHECKPOINT_RATE_LIMIT_MAX_PER_HOUR", uint256(120));
            SubmitRateLimitExtension(rateLimit).setMaxBatchesPerHour(maxPerHour);
            console.log("RateLimit max/hour", maxPerHour);
        }

        address timelock = vm.envOr("EXT_TIMELOCK", address(0));
        if (timelock != address(0)) {
            uint256 delay = vm.envOr("CHECKPOINT_TIMELOCK_DELAY_SECONDS", uint256(48 hours));
            TimelockSubmitExtension(timelock).setDelay(delay);
            console.log("Timelock delay", delay);
        }

        address validator = vm.envOr("EXT_VALIDATOR_SIG", address(0));
        if (validator != address(0)) {
            address hub = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
            ValidatorSigVerifierExtension(validator).setVerifyingContract(hub);
            uint256 threshold = vm.envOr("CHECKPOINT_VALIDATOR_THRESHOLD", uint256(1));
            address[] memory addrs = new address[](1);
            addrs[0] = vm.envOr("CHECKPOINT_VALIDATOR_ADDRESS", vm.addr(pk));
            ValidatorSigVerifierExtension(validator).setValidators(addrs, threshold);
        }

        address tokenFilter = vm.envOr("EXT_TOKEN_FILTER", address(0));
        if (tokenFilter != address(0)) {
            TokenTransferFilterExtension filter = TokenTransferFilterExtension(tokenFilter);
            bool allowNative = vm.envOr("CHECKPOINT_TOKEN_FILTER_ALLOW_NATIVE", true);
            uint256 minNative = vm.envOr("CHECKPOINT_TOKEN_FILTER_MIN_NATIVE_WEI", uint256(0));
            filter.setAllowNative(allowNative, minNative);
            _allowToken(filter, vm.envOr("CUSDT_CHAIN138", address(0)));
            _allowToken(filter, vm.envOr("CUSDC_CHAIN138", address(0)));
        }

        address zk = vm.envOr("EXT_ZK_STATE_ROOT", address(0));
        if (zk != address(0)) {
            bool requireZk = vm.envOr("CHECKPOINT_REQUIRE_ZK_PROOF", false);
            ZkStateRootVerifierExtension(zk).setRequireZkProof(requireZk);
        }

        address blockOracle = vm.envOr("EXT_BLOCK_ORACLE", address(0));
        if (blockOracle != address(0)) {
            BlockHeaderOracleExtension oracle = BlockHeaderOracleExtension(blockOracle);
            oracle.setRequireOracleRecord(vm.envOr("CHECKPOINT_BLOCK_ORACLE_REQUIRED", true));
            address updater = vm.envOr("CHECKPOINT_ORACLE_UPDATER", vm.addr(pk));
            oracle.grantRole(keccak256("ORACLE_UPDATER_ROLE"), updater);
        }

        address minPay = vm.envOr("EXT_MIN_PAYMENT", address(0));
        address hubProxy = vm.envOr("CHAIN138_MAINNET_CHECKPOINT_PROXY", address(0));
        if (minPay != address(0) && hubProxy != address(0)) {
            MinPaymentValueExtension(minPay).setHub(hubProxy);
        }

        vm.stopBroadcast();
    }

    function _allowToken(TokenTransferFilterExtension filter, address token) internal {
        if (token == address(0)) return;
        filter.setAllowedToken(token, true);
        console.log("Allowed token", token);
    }
}