"""
Auth Configuration — JWT Settings

Provides centralized JWT configuration loaded from environment variables.
Falls back to safe defaults for development.

Architecture Reference: insights/architecture_rule.md
    Phase 2: "Implement JWT Authentication and RBAC in auth_controller.py"

Required env vars (add to .env):
    JWT_SECRET_KEY=your-super-secret-key-change-in-production
    JWT_ALGORITHM=HS256
    JWT_ACCESS_TOKEN_EXPIRE_MINUTES=60
"""

import os
from dataclasses import dataclass


@dataclass(frozen=True)
class AuthConfig:
    """Immutable JWT configuration."""

    secret_key: str
    algorithm: str
    access_token_expire_minutes: int


def get_auth_config() -> AuthConfig:
    """
    Load auth configuration from environment.

    Returns:
        AuthConfig with JWT settings from env vars or safe defaults.

    Note:
        The default secret key is intentionally weak — it will work in dev
        but MUST be overridden in production via JWT_SECRET_KEY env var.
    """
    secret = os.getenv("JWT_SECRET_KEY", "dev-secret-key-change-me-in-production")

    if secret == "dev-secret-key-change-me-in-production":
        import logging
        logging.getLogger(__name__).warning(
            "⚠️  Using default JWT secret key — set JWT_SECRET_KEY env var for production!"
        )

    return AuthConfig(
        secret_key=secret,
        algorithm=os.getenv("JWT_ALGORITHM", "HS256"),
        access_token_expire_minutes=int(
            os.getenv("JWT_ACCESS_TOKEN_EXPIRE_MINUTES", "60")
        ),
    )


# Singleton — loaded once at module import
auth_config = get_auth_config()