"""Application settings, read from environment variables.

Two separate database DSNs are deliberate, not an oversight — see db.py for why: one connects
as a role with BYPASSRLS (used only by the auth bootstrap path, which must look identity up
*before* it can be scoped), the other as a normal RLS-subject role (used for every other query).
"""

from functools import lru_cache

from pydantic import PostgresDsn
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_prefix="VELODROME_", extra="ignore")

    # Scoped role: NOBYPASSRLS. Every request-handling query outside the auth bootstrap uses this.
    database_url_app: PostgresDsn
    # Bootstrap role: BYPASSRLS. Used ONLY by velodrome.auth.service for the pre-identity lookups
    # (login by email, session-by-token, invite-by-code) and for creating new users/sessions.
    database_url_auth: PostgresDsn

    # AES-GCM key for encrypting third-party credentials (e.g. the Bryton digest, added in a later
    # phase). Not used yet in Phase 0, but declared now so the settings shape is stable.
    secret_key: str = "dev-only-insecure-placeholder-change-me"

    session_cookie_name: str = "vd_session"
    session_ttl_days: int = 90
    public_url: str = "http://localhost:5173"

    environment: str = "development"


@lru_cache
def get_settings() -> Settings:
    return Settings()