"""Auth policy read from the environment — deliberately NOT pydantic
settings: these are read lazily at call time (like the kit's bw_auth
env handling) so tests can flip them per-case with monkeypatch and the
startup guard sees the real current env.
"""

import os


def app_env() -> str:
    """Deployment flavor. The container compose sets APP_ENV=production;
    anything else (development/test/unset-on-a-laptop) counts as non-prod.
    Defaults to "production" so a missing flag can never ENABLE dev-only
    behavior."""
    return (os.environ.get("APP_ENV") or "production").strip().lower()


def is_production() -> bool:
    return app_env() == "production"


def dev_user() -> str:
    """AUTH_DEV_USER — the local-test identity stub (judgment #13).
    When set in a NON-production env, requests resolve to this username
    without a session. Production refuses to start with it set."""
    return (os.environ.get("AUTH_DEV_USER") or "").strip()


def enforce_dev_stub_policy() -> None:
    """T-AZ-043: AUTH_DEV_USER set in a production env -> refuse to start.
    Called from create_app(), so the container dies loudly at boot rather
    than serving with an identity backdoor."""
    if is_production() and dev_user():
        raise RuntimeError(
            "AUTH_DEV_USER is set but APP_ENV=production — the dev identity "
            "stub is a local-test convenience and must never run in "
            "production (judgment #13 / T-AZ-043). Unset AUTH_DEV_USER."
        )