"""PM settings — env prefix PM_ (mirrors the ERP PROCUREMENT_ pattern)."""
from pathlib import Path

from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_prefix="PM_", env_file=".env", extra="ignore")

    DATABASE_URL: str = "postgresql+asyncpg://pm:pm@localhost:5432/pm"
    SESSION_SECRET: str = "change-me"
    SESSION_TTL_HOURS: int = 24 * 14

    ADMIN_USER: str = "admin"
    ADMIN_PASSWORD: str = "admin"

    # Development role switching — the dashboard shows a role picker so the two
    # roles can be tried without separate logins. Set PM_DEV_ROLE_SWITCH=false
    # (production) to disable the dev endpoints entirely.
    DEV_ROLE_SWITCH: bool = False
    DEV_SUPERVISOR_USER: str = "supervisor"
    DEV_SUPERVISOR_PASSWORD: str = "pm123456"
    DEV_SUPERVISOR2_USER: str = "supervisor2"
    DEV_SUPERVISOR2_PASSWORD: str = "pm123456"

    def dev_demo_usernames(self) -> list[str]:
        """Accounts the dev role switcher may log in as (manager + supervisors)."""
        return [self.ADMIN_USER, self.DEV_SUPERVISOR_USER, self.DEV_SUPERVISOR2_USER]

    FILES_DIR: Path = Path("/data/files")

    # ERP (procurement/inventory) integration — read-only service account
    ERP_BASE_URL: str = "http://procurement-api:8000"
    ERP_CASDOOR_ENDPOINT: str = "http://casdoor:8000"
    ERP_CASDOOR_CLIENT_ID: str = "inventory-app-client"
    ERP_CASDOOR_CLIENT_SECRET: str = "inventory-app-secret-2026"
    ERP_CASDOOR_ORGANIZATION: str = "inventory"
    ERP_SERVICE_USERNAME: str = "pm-service"
    ERP_SERVICE_PASSWORD: str = ""
    ERP_CACHE_TTL_SECONDS: int = 120

    # Casdoor SSO — PM accepts the ERP-issued JWT as its own session.
    # ISSUER = the browser-facing origin Casdoor advertises (casdoor `origin`),
    # not the in-network endpoint; AUDIENCE = the inventory-app client id.
    CASDOOR_ISSUER: str = "http://localhost:8080"
    CASDOOR_AUDIENCE: str = "inventory-app-client"


settings = Settings()