"""Deployment configuration; secrets are required and never included in API responses."""

from cryptography.fernet import Fernet
from pydantic import Field, SecretStr, model_validator
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file="../.env", extra="ignore")

    database_url: str = "postgresql+asyncpg://wq:wq@localhost:5432/wq"
    admin_username: str = "admin"
    admin_password: SecretStr = Field(min_length=12)
    encryption_key: SecretStr
    public_origin: str = "http://localhost:8080"
    cookie_secure: bool = False
    session_hours: int = Field(default=24, ge=1, le=168)
    wq_base_url: str = "https://api.worldquantbrain.com"
    request_timeout: float = 30
    retry_attempts: int = Field(default=4, ge=1, le=8)
    enable_runner: bool = True
    ai_request_limit: int = Field(default=6, ge=1, le=30)
    ai_tool_limit: int = Field(default=12, ge=1, le=100)
    ai_output_tokens: int = Field(default=4096, ge=128, le=32768)
    ai_timeout: float = Field(default=180, ge=1, le=600)

    @model_validator(mode="after")
    def validate_secrets(self):
        Fernet(self.encryption_key.get_secret_value().encode())
        if self.cookie_secure and not self.public_origin.startswith("https://"):
            raise ValueError("COOKIE_SECURE requires an HTTPS PUBLIC_ORIGIN")
        return self