"""Application settings, read from environment (12-factor).

Secrets (BW client id/secret) come from the 0600 .bw-auth.env file the
owner stages via `srv-gw app-client-register --secret-out` — never
hardcoded, never logged. The compose file injects them (plus BW_AUTH /
BW_APP_DOMAIN / APP_ENV) as real process env vars.

NOTE — the auth stack does NOT read these pydantic snapshots. It reads
the SAME env vars lazily at call time (bw_auth.py reads BW_CLIENT_ID /
BW_CLIENT_SECRET / BW_AUTH / BW_APP_DOMAIN; services/auth/config.py
reads APP_ENV / AUTH_DEV_USER; services/auth/session.py reads
SESSION_SECRET / BW_CLIENT_SECRET), exactly like /srv/apps/with — so
tests can flip them per-case and the boot guard sees the live env. The
fields here document the one env contract and serve non-auth readers.
"""
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env", extra="ignore")

    # Database (the compose postgres sidecar, project-internal network only).
    database_url: str = "postgresql+psycopg2://volleyboard:volleyboard@db:5432/volleyboard"

    # Uploads (pasted screenshots) live on a bind-mounted volume, served
    # through an authed route — never web-root-served.
    upload_dir: str = "/app/data/uploads"

    # ---- BW Auth (Pattern B) — env names shared with /srv/apps/with ----
    # BW_CLIENT_ID / BW_CLIENT_SECRET arrive via .bw-auth.env (0600).
    bw_client_id: str = ""
    bw_client_secret: str = ""
    bw_auth: str = "https://auth.bowden.works"
    bw_app_domain: str = "https://volleyboard.bowden.works"

    # Deployment flavor. Defaults to "production" so a missing flag can
    # never ENABLE dev-only behavior.
    app_env: str = "production"

    # DEV ONLY: resolve every request as this username with no OAuth (the
    # overnight build/screenshot stub). create_app() REFUSES to start when
    # this is set with APP_ENV=production.
    auth_dev_user: str | None = None

    # Optional explicit app-session signing secret; when unset the session
    # key is derived from BW_CLIENT_SECRET (see services/auth/session.py).
    session_secret: str | None = None


settings = Settings()