"""Application configuration for the admin backend."""

import json
from typing import List, Optional

from pydantic import Field, field_validator
from pydantic_settings import BaseSettings, SettingsConfigDict


def _json_loads(value: str):
    try:
        return json.loads(value)
    except json.JSONDecodeError:
        return value


class Settings(BaseSettings):
    """Environment-driven configuration."""

    model_config = SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
        env_prefix="",
        populate_by_name=True,
        json_loads=_json_loads,
    )

    app_name: str = Field(default="Web Sentinel Admin")
    debug: bool = Field(default=False)

    # Database
    database_url: str = Field(alias="WEB_SENTINEL_POSTGRES_URL")

    # Auth / security
    admin_jwt_secret: str = Field(alias="WEB_SENTINEL_ADMIN_JWT_SECRET")
    admin_token_exp_minutes: int = Field(default=60)
    admin_allowed_domains: List[str] = Field(
        default_factory=lambda: ["web-sentinel.com", "taaazzz-prog.fr"],
        alias="WEB_SENTINEL_ADMIN_ALLOWED_DOMAINS",
    )
    admin_oidc_client_secret: Optional[str] = Field(
        default=None, alias="WEB_SENTINEL_ADMIN_OIDC_CLIENT_SECRET"
    )
    admin_oidc_audience: Optional[str] = Field(
        default=None, alias="WEB_SENTINEL_ADMIN_OIDC_AUDIENCE"
    )
    admin_oidc_issuer: Optional[str] = Field(
        default=None, alias="WEB_SENTINEL_ADMIN_OIDC_ISSUER"
    )
    admin_oidc_allowed_groups: List[str] = Field(
        default_factory=list, alias="WEB_SENTINEL_ADMIN_OIDC_ALLOWED_GROUPS"
    )
    admin_oidc_mfa_claim: str = Field(
        default="mfa_authenticated", alias="WEB_SENTINEL_ADMIN_OIDC_MFA_CLAIM"
    )

    @field_validator("admin_allowed_domains", "admin_oidc_allowed_groups", mode="before")
    @classmethod
    def _split_comma_separated(cls, value):
        if isinstance(value, str):
            return [item.strip() for item in value.split(",") if item.strip()]
        return value


settings = Settings()  # type: ignore[call-arg]