"""Application configuration.

Settings are read from environment variables first, then from a `.env` file.
Environment variables always take precedence over the file.
"""

from functools import lru_cache

from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
        case_sensitive=False,
    )

    # General
    app_name: str = "FastAPI Skeleton"
    debug: bool = False

    # Security / JWT
    secret_key: str = "change-me-please-use-a-long-random-string"
    algorithm: str = "HS256"
    access_token_expire_minutes: int = 15
    refresh_token_expire_days: int = 7

    # Database — single URL drives SQLite or Postgres.
    #   SQLite:   sqlite+aiosqlite:///./app.db
    #   Postgres: postgresql+asyncpg://user:pass@host:5432/dbname
    database_url: str = "sqlite+aiosqlite:///./app.db"
    auto_create_tables: bool = True

    # Web / cookies (the HTMX UI stores the access token in an httpOnly cookie).
    # session_timeout_hours governs how long a browser login lasts before the
    # user is bounced back to /login; it's independent of the JSON API's
    # short-lived access_token_expire_minutes.
    cookie_name: str = "access_token"
    cookie_secure: bool = False
    session_timeout_hours: int = 24

    # LDAP (direct-bind). When enabled, the login page offers an LDAP option.
    # At login the user's DN is built from ``ldap_bind_dn_template`` (with
    # ``{username}`` substituted) and bound directly with their password.
    ldap_enabled: bool = False
    ldap_host: str = "localhost"
    ldap_port: int = 389
    ldap_use_ssl: bool = False
    ldap_bind_dn_template: str = "uid={username},ou=people,dc=example,dc=com"
    # Provisioned LDAP users get a synthesized email: "<username>@<domain>".
    ldap_email_domain: str = "example.com"
    # LDAP attribute read for the provisioned user's display name.
    ldap_full_name_attr: str = "cn"

    # CORS
    cors_origins: list[str] = ["*"]

    # Bootstrap superuser (used by scripts/seed.py)
    first_superuser_email: str = "admin@example.com"
    first_superuser_password: str = "changethis"


@lru_cache
def get_settings() -> Settings:
    return Settings()


settings = get_settings()