from functools import lru_cache
from typing import Literal, Optional

from pydantic import Field
from pydantic_settings import BaseSettings, SettingsConfigDict

PROTECTED_ADMIN_EMAIL = "admin@huapont.cn"
PROTECTED_ADMIN_DEFAULT_PASSWORD = "admin123"
PROTECTED_ADMIN_FULL_NAME = "System Admin"
PROTECTED_ADMIN_CLINICAL_DEPARTMENT = "SYSTEM"


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")

    DATABASE_URL: str = Field(default="postgresql+asyncpg://postgres:postgres@db:5432/ctms")
    ENV: Literal["development", "production", "test"] = "development"
    JWT_SECRET_KEY: str = "dev-secret"
    JWT_EXPIRE_MINUTES: int = 60
    JWT_EXTEND_GRACE_SECONDS: int = 120
    ABSOLUTE_SESSION_MAX_HOURS: int = 8
    LOGIN_RSA_PRIVATE_KEY: Optional[str] = None
    LOGIN_RSA_PUBLIC_KEY: Optional[str] = None
    LOGIN_RSA_KEY_ID: str = "default"
    LOGIN_CHALLENGE_TTL_SECONDS: int = 120
    LOGIN_CHALLENGE_MAX_ACTIVE: int = 1000
    SETTINGS_ENCRYPTION_KEY: Optional[str] = None
    FRONTEND_PUBLIC_URL: str = "http://localhost:8888"
    CORS_ALLOWED_ORIGINS: str = (
        "http://localhost:8888,http://localhost:5173,"
        "tauri://localhost,http://tauri.localhost"
    )
    IP2REGION_XDB_PATH: Optional[str] = None
    IP2REGION_IPV6_XDB_PATH: Optional[str] = None


@lru_cache
def get_settings() -> Settings:
    return Settings()


settings = get_settings()


def get_cors_allowed_origins() -> list[str]:
    return [
        origin.strip()
        for origin in settings.CORS_ALLOWED_ORIGINS.split(",")
        if origin.strip()
    ]