"""Application configuration.

All settings can be overridden with environment variables prefixed with
``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env`` file.
"""
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        env_prefix="PROCUREMENT_",
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

    # PostgreSQL DSN — the schema (migration.sql + seed.sql) must already exist.
    DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/procurement"

    # Echo SQL statements to the console (dev aid).
    DEBUG_SQL: bool = False

    # MinIO object storage — invoice / proforma attachments (S3-compatible).
    # Endpoint is the compose service name (`minio:9000`) inside Docker.
    MINIO_ENDPOINT: str = "localhost:9000"
    MINIO_ACCESS_KEY: str = "minioadmin"
    MINIO_SECRET_KEY: str = "minioadmin"
    MINIO_BUCKET: str = "procurement-files"
    MINIO_SECURE: bool = False

    # Background auto-expiry of offered quotes whose expiry_date has passed.
    AUTO_EXPIRE_ENABLED: bool = True
    AUTO_EXPIRE_INTERVAL_SECONDS: int = 3600

    # Pagination limits (contract: default 20, max 100).
    DEFAULT_PAGE_SIZE: int = 20
    MAX_PAGE_SIZE: int = 100

    # CORS (dev-friendly default; the frontend is a static site).
    CORS_ORIGINS: list[str] = ["*"]

    # Casdoor (OIDC) — JWT verification against the issuer's JWKS.
    CASDOOR_ENDPOINT: str = "http://localhost:8080"
    CASDOOR_ISSUER: str = ""  # expected token iss claim (default: CASDOOR_ENDPOINT)
    CASDOOR_CLIENT_ID: str = "inventory-app-client"
    CASDOOR_CLIENT_SECRET: str = "inventory-app-secret-2026"
    CASDOOR_ORGANIZATION: str = "inventory"
    CASDOOR_APP_NAME: str = "inventory-app"
    CASDOOR_JWKS_URL: str = ""  # default: {endpoint}/api/public_jwks
    CASDOOR_AUDIENCE: str = "inventory-app-client"  # expected token aud (falls back to client_id)

    # Casdoor console admin — used by POST /users/sync to mirror Casdoor
    # identities into the app's users table (dev defaults: admin / 123).
    CASDOOR_ADMIN_USER: str = "admin"
    CASDOOR_ADMIN_PASSWORD: str = "123"

    # Inventory dev fallback (only when no Authorization header is sent).
    INVENTORY_DEFAULT_ROLE: str = "pm"
    INVENTORY_DEFAULT_PROJECT_ID: str = ""


settings = Settings()