from functools import lru_cache
from typing import Literal, Optional
from urllib.parse import urlsplit

from pydantic import Field
from pydantic_settings import BaseSettings, SettingsConfigDict

PROTECTED_ADMIN_EMAIL = "admin@huapont.cn"
PROTECTED_ADMIN_DEFAULT_PASSWORD = "admin123"
PROTECTED_ADMIN_FULL_NAME = "System Admin"
PROTECTED_ADMIN_CLINICAL_DEPARTMENT = "SYSTEM"


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")

    DATABASE_URL: str = Field(default="postgresql+asyncpg://postgres:postgres@db:5432/ctms")
    ENV: Literal["development", "production", "test"] = "development"
    JWT_SECRET_KEY: str = "dev-secret"
    JWT_EXPIRE_MINUTES: int = 60
    JWT_EXTEND_GRACE_SECONDS: int = 120
    ABSOLUTE_SESSION_MAX_HOURS: int = 8
    DESKTOP_SESSION_MAX_DAYS: int = 30
    LOGIN_RSA_PRIVATE_KEY: Optional[str] = None
    LOGIN_RSA_PUBLIC_KEY: Optional[str] = None
    LOGIN_RSA_KEY_ID: str = "default"
    LOGIN_CHALLENGE_TTL_SECONDS: int = 120
    LOGIN_CHALLENGE_MAX_ACTIVE: int = 1000
    SETTINGS_ENCRYPTION_KEY: Optional[str] = None
    FRONTEND_PUBLIC_URL: str = "http://localhost:8888"
    CORS_ALLOWED_ORIGINS: str = (
        "http://localhost:8888,http://localhost:5173,"
        "tauri://localhost,http://tauri.localhost"
    )
    IP2REGION_XDB_PATH: Optional[str] = None
    IP2REGION_IPV6_XDB_PATH: Optional[str] = None
    TRUSTED_PROXY_CIDRS: str = "127.0.0.1/32,::1/128,172.16.0.0/12"
    MONITORING_SERVER_PUBLIC_IP: Optional[str] = None
    MONITORING_PUBLIC_IP_DISCOVERY_URLS: str = (
        "https://api64.ipify.org,https://icanhazip.com"
    )
    MONITORING_PUBLIC_IP_DISCOVERY_TIMEOUT_SECONDS: float = Field(default=2.5, ge=0.5, le=10)
    MONITORING_SERVER_LOCATION_CACHE_SECONDS: int = Field(default=86400, ge=300, le=604800)
    MONITORING_IP_GEO_FALLBACK_ENABLED: bool = True
    MONITORING_IP_GEO_FALLBACK_API_KEY: Optional[str] = None
    MONITORING_IP_GEO_FALLBACK_TIMEOUT_SECONDS: float = Field(default=2.5, ge=0.5, le=10)
    MONITORING_IP_GEO_FALLBACK_CACHE_SECONDS: int = Field(default=604800, ge=3600, le=2592000)
    MONITORING_IP_GEO_FALLBACK_MAX_LOOKUPS: int = Field(default=10, ge=1, le=100)
    MONITORING_ACCESS_LOG_RETENTION_DAYS: int = Field(default=90, ge=7, le=3650)
    MONITORING_METRIC_RETENTION_DAYS: int = Field(default=400, ge=30, le=3650)
    MONITORING_RETENTION_INTERVAL_SECONDS: int = Field(default=86400, ge=60, le=604800)
    USER_LOGIN_ACTIVITY_RETENTION_DAYS: int = Field(default=180, ge=30, le=3650)
    USER_SESSION_ONLINE_SECONDS: int = Field(default=300, ge=60, le=3600)
    NOTIFICATION_SYNC_INTERVAL_SECONDS: int = Field(default=300, ge=60, le=3600)
    ONLYOFFICE_ENABLED: bool = False
    ONLYOFFICE_JWT_SECRET: Optional[str] = None
    ONLYOFFICE_INTERNAL_URL: str = "http://onlyoffice"
    ONLYOFFICE_STORAGE_BASE_URL: str = "http://backend:8000"
    ONLYOFFICE_INSTANCE_ID: Optional[str] = None
    ONLYOFFICE_CONFIG_TTL_SECONDS: int = Field(default=300, ge=60, le=900)
    COLLABORATION_MAX_FILE_BYTES: int = Field(default=50 * 1024 * 1024, ge=1024, le=500 * 1024 * 1024)


@lru_cache
def get_settings() -> Settings:
    return Settings()


settings = get_settings()


def validate_onlyoffice_configuration() -> None:
    if not settings.ONLYOFFICE_ENABLED:
        return
    secret = (settings.ONLYOFFICE_JWT_SECRET or "").strip()
    instance_id = (settings.ONLYOFFICE_INSTANCE_ID or "").strip()
    if secret == settings.JWT_SECRET_KEY:
        raise RuntimeError("ONLYOFFICE_JWT_SECRET must not reuse JWT_SECRET_KEY")
    if len(secret) < 32:
        raise RuntimeError("ONLYOFFICE_JWT_SECRET must contain at least 32 characters when ONLYOFFICE is enabled")
    if not instance_id:
        raise RuntimeError("ONLYOFFICE_INSTANCE_ID is required when ONLYOFFICE is enabled")
    for name, value in (
        ("ONLYOFFICE_INTERNAL_URL", settings.ONLYOFFICE_INTERNAL_URL),
        ("ONLYOFFICE_STORAGE_BASE_URL", settings.ONLYOFFICE_STORAGE_BASE_URL),
    ):
        parsed = urlsplit(value.strip())
        if parsed.scheme.lower() not in {"http", "https"} or not parsed.hostname:
            raise RuntimeError(f"{name} must be an HTTP(S) URL")
        if parsed.username or parsed.password or parsed.query or parsed.fragment:
            raise RuntimeError(f"{name} must not contain credentials, a query, or a fragment")
        if parsed.path not in {"", "/"}:
            raise RuntimeError(f"{name} must not contain a path")


def get_cors_allowed_origins() -> list[str]:
    return [
        origin.strip()
        for origin in settings.CORS_ALLOWED_ORIGINS.split(",")
        if origin.strip()
    ]