from __future__ import annotations

from functools import lru_cache
from pathlib import Path

from pydantic import Field, field_validator
from pydantic_settings import BaseSettings, SettingsConfigDict

PROJECT_ROOT = Path(__file__).resolve().parents[2]


class Settings(BaseSettings):
    app_name: str = "Secure E-commerce API"
    api_v1_prefix: str = "/api/v1"
    database_url: str = "sqlite:///./ecommerce.db"
    jwt_secret_key: str = Field(min_length=32)
    jwt_algorithm: str = "HS256"
    jwt_issuer: str = "secure-ecommerce-api"
    jwt_audience: str = "secure-ecommerce-clients"
    access_token_expire_minutes: int = Field(default=30, ge=5, le=120)
    auth_rate_limit_attempts: int = Field(default=5, ge=3, le=20)
    auth_rate_limit_window_seconds: int = Field(default=300, ge=60, le=3600)
    auth_rate_limit_max_buckets: int = Field(default=5000, ge=100, le=100_000)
    log_level: str = "INFO"
    demo_seed_products: bool = False
    demo_product_count: int = Field(default=220, ge=0, le=1000)

    model_config = SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        case_sensitive=False,
        extra="ignore",
    )

    @field_validator("jwt_secret_key")
    @classmethod
    def validate_jwt_secret_key(cls, value: str) -> str:
        insecure_values = {
            "change-this-secret-in-production",
            "replace-with-a-long-random-secret",
        }
        if value in insecure_values:
            raise ValueError("JWT_SECRET_KEY must be replaced with a strong random secret")
        return value

    @field_validator("database_url")
    @classmethod
    def validate_database_url(cls, value: str) -> str:
        sqlite_prefix = "sqlite:///"
        if not value.startswith(sqlite_prefix):
            return value

        raw_path = value[len(sqlite_prefix):]
        if raw_path == ":memory:":
            return value
        if (
            len(raw_path) >= 3
            and raw_path[1] == ":"
            and raw_path[0].isalpha()
            and raw_path[2] in {"/", "\\"}
        ):
            raise ValueError(
                "SQLite database file must stay inside the project directory"
            )

        candidate = Path(raw_path)
        resolved = candidate.resolve() if candidate.is_absolute() else (PROJECT_ROOT / candidate).resolve()
        try:
            resolved.relative_to(PROJECT_ROOT)
        except ValueError as exc:
            raise ValueError("SQLite database file must stay inside the project directory") from exc

        normalized_relative_path = resolved.relative_to(PROJECT_ROOT).as_posix()
        return f"{sqlite_prefix}./{normalized_relative_path}"


@lru_cache
def get_settings() -> Settings:
    return Settings()  # type: ignore[call-arg]