"""Application configuration via pydantic-settings.

All values are read from environment variables / .env file.
See .env.example for the full list.
"""

from functools import lru_cache

from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    """Central application settings."""

    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")

    # Core
    app_env: str = "development"
    app_name: str = "Insight Updater"
    secret_key: str = "dev-secret-change-me-32-chars-min"
    encryption_key: str = ""
    log_level: str = "INFO"
    log_format: str = "json"

    # JWT
    jwt_algorithm: str = "RS256"
    jwt_private_key_path: str = "keys/private.pem"
    jwt_public_key_path: str = "keys/public.pem"
    jwt_access_token_expire_minutes: int = 30
    jwt_refresh_token_expire_days: int = 7

    # Database / Redis
    database_url: str = "sqlite+aiosqlite:///./data/app.db"
    redis_url: str = "redis://localhost:6379/0"

    # WinRM
    winrm_transport: str = "ntlm"
    winrm_cert_validation: str = "ignore"
    winrm_operation_timeout: int = 60
    winrm_read_timeout: int = 120
    winrm_kerberos_delegation: bool = True

    # SSH
    ssh_timeout: int = 30

    # LDAP (stub)
    ldap_enabled: bool = False
    ldap_uri: str = ""
    ldap_bind_dn: str = ""
    ldap_bind_password: str = ""
    ldap_user_search_base: str = ""
    ldap_user_filter: str = "(sAMAccountName={username})"

    # CORS
    cors_origins: str = "http://localhost:3000,http://localhost:8000"

    @property
    def cors_origin_list(self) -> list[str]:
        return [o.strip() for o in self.cors_origins.split(",") if o.strip()]

    @property
    def is_production(self) -> bool:
        return self.app_env.lower() == "production"


@lru_cache
def get_settings() -> Settings:
    return Settings()