class TraefikLabelGenerator:
    def __init__(self, domain: str, entrypoint: str = "websecure"):
        self.domain = domain
        self.entrypoint = entrypoint

    def generate_subdomain(
        self,
        tool_key: str,
        project_slug: str,
        user_slug: str,
    ) -> str:
        return f"{tool_key}-{project_slug}-{user_slug}.{self.domain}"

    def generate_labels(
        self,
        instance_id: str,
        tool_key: str,
        project_slug: str,
        user_slug: str,
        container_port: int,
        network_name: str = "tools",
    ) -> dict[str, str]:
        subdomain = self.generate_subdomain(tool_key, project_slug, user_slug)
        router_name = f"tool-{instance_id[:8]}"
        service_name = f"tool-{instance_id[:8]}"

        labels: dict[str, str] = {}

        labels["traefik.enable"] = "true"

        labels[f"traefik.http.routers.{router_name}.rule"] = (
            f"Host(`{subdomain}`)"
        )
        labels[f"traefik.http.routers.{router_name}.entrypoints"] = (
            self.entrypoint
        )
        labels[f"traefik.http.routers.{router_name}.service"] = service_name

        if self.entrypoint == "websecure":
            labels[f"traefik.http.routers.{router_name}.tls"] = "true"
            labels[
                f"traefik.http.routers.{router_name}.tls.certresolver"
            ] = "letsencrypt"

        labels[f"traefik.http.services.{service_name}.loadbalancer.server.port"] = (
            str(container_port)
        )
        labels[f"traefik.http.services.{service_name}.loadbalancer.server.scheme"] = (
            "http"
        )

        middleware_name = f"tool-{instance_id[:8]}-sec"
        labels[
            f"traefik.http.middlewares.{middleware_name}.headers.stsSeconds"
        ] = "31536000"
        labels[
            f"traefik.http.middlewares.{middleware_name}.headers.stsIncludeSubdomains"
        ] = "true"
        labels[
            f"traefik.http.middlewares.{middleware_name}.headers.forceStsHeader"
        ] = "true"
        labels[
            f"traefik.http.middlewares.{middleware_name}.headers.contentTypeNosniff"
        ] = "true"
        labels[
            f"traefik.http.middlewares.{middleware_name}.headers.browserXssFilter"
        ] = "true"
        labels[
            f"traefik.http.middlewares.{middleware_name}.headers.customFrameOptionsValue"
        ] = "SAMEORIGIN"

        labels[f"traefik.http.routers.{router_name}.middlewares"] = middleware_name

        labels["traefik.docker.network"] = network_name

        return labels

    def generate_forward_auth_labels(
        self,
        instance_id: str,
        auth_url: str,
    ) -> dict[str, str]:
        router_name = f"tool-{instance_id[:8]}"
        middleware_name = f"tool-{instance_id[:8]}-auth"

        return {
            f"traefik.http.middlewares.{middleware_name}.forwardauth.address": auth_url,
            f"traefik.http.middlewares.{middleware_name}.forwardauth.trustForwardHeader": "true",
            f"traefik.http.routers.{router_name}.middlewares": middleware_name,
        }

    def generate_removal_labels(
        self,
        instance_id: str,
    ) -> dict[str, str]:
        router_name = f"tool-{instance_id[:8]}"

        return {
            "traefik.enable": "false",
            f"traefik.http.routers.{router_name}.rule": "",
        }