"""Shared Django settings for coulomb.social."""

from pathlib import Path

from decouple import Csv, config
from dj_database_url import parse as parse_db_url

BASE_DIR = Path(__file__).resolve().parent.parent.parent

SECRET_KEY = config("SECRET_KEY", default="django-insecure-change-me-in-production")
DEBUG = config("DEBUG", default=False, cast=bool)
ALLOWED_HOSTS = config("ALLOWED_HOSTS", default="localhost,127.0.0.1", cast=Csv())

INSTALLED_APPS = [
    "django.contrib.admin",
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "django.contrib.staticfiles",
    "coulomb_social.apps.core",
    "coulomb_social.apps.members",
    "coulomb_social.apps.identity",
    "coulomb_social.apps.spaces",
]

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "whitenoise.middleware.WhiteNoiseMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
]

ROOT_URLCONF = "coulomb_social.urls"

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "DIRS": [BASE_DIR / "coulomb_social" / "templates"],
        "APP_DIRS": True,
        "OPTIONS": {
            "context_processors": [
                "django.template.context_processors.debug",
                "django.template.context_processors.request",
                "django.contrib.auth.context_processors.auth",
                "django.contrib.messages.context_processors.messages",
                "coulomb_social.apps.core.context_processors.site_context",
            ],
        },
    },
]

WSGI_APPLICATION = "coulomb_social.wsgi.application"
ASGI_APPLICATION = "coulomb_social.asgi.application"

DATABASES = {
    "default": parse_db_url(
        config(
            "DATABASE_URL",
            default=f"sqlite:///{BASE_DIR / 'db.sqlite3'}",
        )
    )
}

AUTH_USER_MODEL = "members.User"

AUTH_PASSWORD_VALIDATORS: list[dict[str, str]] = []  # no local passwords

LANGUAGE_CODE = "en-us"
TIME_ZONE = "Europe/Berlin"
USE_I18N = True
USE_TZ = True

STATIC_URL = "/static/"
STATIC_ROOT = BASE_DIR / "staticfiles"
STATICFILES_DIRS = [BASE_DIR / "static"] if (BASE_DIR / "static").exists() else []
STORAGES = {
    "staticfiles": {
        "BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
    },
}

DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"

LOGIN_URL = "identity:login"
LOGIN_REDIRECT_URL = "core:app_home"
LOGOUT_REDIRECT_URL = "core:landing"

# ── Tenant (KeyCape default platform tenant; Binky friendly slug later) ─────
DEFAULT_TENANT_ID = config("DEFAULT_TENANT_ID", default="tenant:coulomb")

# ── NetKingdom identity (see ADR-0001) ──────────────────────────────────────
# When OIDC_ENABLED is false, only the DEBUG dev-login path is available.
OIDC_ENABLED = config("OIDC_ENABLED", default=False, cast=bool)
OIDC_ISSUER = config("OIDC_ISSUER", default="")
OIDC_CLIENT_ID = config("OIDC_CLIENT_ID", default="")
OIDC_CLIENT_SECRET = config("OIDC_CLIENT_SECRET", default="")
OIDC_REDIRECT_URI = config("OIDC_REDIRECT_URI", default="")
OIDC_SCOPES = config("OIDC_SCOPES", default="openid profile email groups")
OIDC_DISCOVERY_URL = config("OIDC_DISCOVERY_URL", default="")  # optional override
OIDC_STEP_UP_ACR = config("OIDC_STEP_UP_ACR", default="aal2")
NETKINGDOM_REGISTRATION_URL = config("NETKINGDOM_REGISTRATION_URL", default="")

# user-engine HTTP (empty base or secret → offline stub)
USER_ENGINE_BASE_URL = config("USER_ENGINE_BASE_URL", default="")
USER_ENGINE_PROXY_SECRET = config("USER_ENGINE_PROXY_SECRET", default="")
USER_ENGINE_APPLICATION_ID = config("USER_ENGINE_APPLICATION_ID", default="coulomb-social")
USER_ENGINE_EXPECTED_AUDIENCE = config(
    "USER_ENGINE_EXPECTED_AUDIENCE", default="user-engine-portal"
)

# flex-auth (empty → local vocabulary; URL set → POST /v1/check fail-closed)
FLEX_AUTH_BASE_URL = config("FLEX_AUTH_BASE_URL", default="")
FLEX_AUTH_PROTECTED_SYSTEM_ID = config(
    "FLEX_AUTH_PROTECTED_SYSTEM_ID", default="coulomb-social"
)
FLEX_AUTH_TIMEOUT_SECONDS = config("FLEX_AUTH_TIMEOUT_SECONDS", default=3.0, cast=float)

# ── Space content (Forgejo / ADR-0002) ──────────────────────────────────────
FORGEJO_BASE_URL = config("FORGEJO_BASE_URL", default="https://forgejo.coulomb.social")
FORGEJO_TOKEN = config("FORGEJO_TOKEN", default="")  # optional; public raw needs none
FORGEJO_TIMEOUT_SECONDS = config("FORGEJO_TIMEOUT_SECONDS", default=10.0, cast=float)
# Shared secret for POST /app/spaces/hooks/forgejo/ (push → cache invalidate)
FORGEJO_WEBHOOK_SECRET = config("FORGEJO_WEBHOOK_SECRET", default="")
# Optional local root for offline tests: <root>/<space-slug>/<content_root>/index.md
SPACE_CONTENT_FIXTURE_ROOT = config("SPACE_CONTENT_FIXTURE_ROOT", default="")