using Confluent.Kafka;

public static class KafkaSecurityExtensions
{
    /// <summary>
    /// Applies the configured security protocol and SASL credentials to any
    /// Confluent client config. Called by every producer, consumer, and admin
    /// client so credentials are configured in exactly one place.
    /// </summary>
    public static T ApplySecurity<T>(this T config, KafkaOptions options)
        where T : ClientConfig
    {
        if (Enum.TryParse<SecurityProtocol>(options.SecurityProtocol, true, out var protocol))
            config.SecurityProtocol = protocol;

        if (!string.IsNullOrWhiteSpace(options.SaslMechanism)
            && Enum.TryParse<SaslMechanism>(options.SaslMechanism, true, out var mechanism))
        {
            config.SaslMechanism = mechanism;
            config.SaslUsername = options.SaslUsername;
            config.SaslPassword = options.SaslPassword;
        }

        if (!string.IsNullOrWhiteSpace(options.SslCaLocation))
            config.SslCaLocation = options.SslCaLocation;

        return config;
    }
}