"""pydantic-settings 配置。"""
from __future__ import annotations

from pydantic import Field
from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env", extra="ignore")

    # --- app ---
    APP_ENV: str = "development"
    LOG_LEVEL: str = "INFO"
    # 生产环境强制要求管理鉴权配置,即使 APP_ENV=production 也生效。
    # True 时若 auth_configured() 为 False 则拒绝(503),development 保持 fail-open。
    REQUIRE_ADMIN_AUTH: bool = False

    # --- database ---
    DATABASE_URL: str = "postgresql+asyncpg://football:football@localhost:5432/football"

    # --- LLM (OpenAI-compatible) ---
    LLM_PROVIDER: str = "openai"
    LLM_API_KEY: str = ""
    LLM_BASE_URL: str = "https://api.openai.com/v1"
    LLM_MODEL: str = "gpt-4o"
    LLM_TIMEOUT: int = 60
    # multi-agent 分档: 专家用便宜快模型,终裁用强模型;空则回落 LLM_MODEL
    LLM_SPECIALIST_MODEL: str = ""
    LLM_AGGREGATOR_MODEL: str = ""

    # --- data sources ---
    BZZOIRO_KEY: str = ""
    BZZOIRO_BASE: str = "https://sports.bzzoiro.com/api/v2"

    # --- 代理头信任 ---
    # 为 True 时才解析 X-Forwarded-For,否则只用 request.client.host。
    # 公网部署时应设为 True,并确保仅 Nginx 等可信反代能访问 API,
    # 且 Nginx 层已覆盖真实 IP(X-Real-IP / proxy_protocol)。
    TRUST_PROXY_HEADERS: bool = False

    # --- CORS ---
    CORS_ORIGINS: str = "http://localhost:5173,http://localhost:3000"
    CORS_METHODS: str = "GET,POST,PUT,DELETE,OPTIONS"
    CORS_HEADERS: str = "Authorization,Content-Type,X-API-Key,Accept"

    # --- HTTP ---
    HTTP_DEFAULT_TIMEOUT: int = 30

    # --- database pool ---
    DB_POOL_SIZE: int = 5
    DB_MAX_OVERFLOW: int = 10
    DB_POOL_TIMEOUT: int = 30
    DB_POOL_RECYCLE: int = 1800

    # --- 管理接口鉴权 ---
    # 管理后台登录密码(POST /api/v1/auth/login),登录后颁发 HttpOnly Cookie 会话。
    # 采集 / 回测等高成本或写入型接口同样需要此密码或下方 API Key。
    # 两者均留空表示「未启用鉴权」(本地开发默认),生产环境必须至少设置一项。
    # 注意:.env 中的 ADMIN_PASSWORD 是初始值;后台修改密码后以数据库中的
    # scrypt 哈希为准,建议随后删除此明文项。
    ADMIN_PASSWORD: str = ""
    ADMIN_API_KEY: str = ""
    # 管理后台会话有效期(小时)
    ADMIN_SESSION_TTL_HOURS: int = 168

    # --- 加密主密钥 ---
    # 敏感配置(数据源/LLM 的 API Key)入库加密、会话签名都由它派生。
    # 只存于部署机 .env,切勿入库或提交代码。生成: openssl rand -base64 32
    # 变更后已加密配置将无法解密(需在后台重新保存)。
    SECRET_KEY: str = ""


settings = Settings()