import logging
import os
import sys
import tempfile

from dotenv import load_dotenv

# Load .env from the repo root regardless of the working directory the process was
# started from. override=False so explicit env vars always win.
ROOT_DIR = os.path.abspath(os.path.dirname(__file__))
_ENV_FILE = os.path.join(ROOT_DIR, ".env")
load_dotenv(_ENV_FILE, override=False)


logger = logging.getLogger("apex")

KNOWN_WEAK_SECRETS = {"super-secret-key", "password", "changeme", "secret", "dev-secret", ""}


class Config:
    def __init__(self):
        self.FLASK_SECRET_KEY = self._require("FLASK_SECRET_KEY")
        self.REDIS_HOST = os.getenv("REDIS_HOST", "localhost")
        self.REDIS_PORT = int(os.getenv("REDIS_PORT", "6379"))
        self.REDIS_DB = int(os.getenv("REDIS_DB", "0"))
        self.REDIS_EXPIRY = int(os.getenv("REDIS_EXPIRY", "86400"))
        self.JWT_EXPIRY = int(os.getenv("JWT_EXPIRY", "1382400"))
        self.HANA_HOST = os.getenv("HANA_HOST", "")
        self.HANA_PORT = int(os.getenv("HANA_PORT", "30015"))
        self.HANA_USER = os.getenv("HANA_USER", "")
        self.HANA_PASSWORD = os.getenv("HANA_PASSWORD", "")
        self.SMTP_HOST = os.getenv("SMTP_HOST", "")
        self.SMTP_PORT = int(os.getenv("SMTP_PORT", "587"))
        self.SMTP_FROM = os.getenv("SMTP_FROM", "")
        self.SMTP_USER    = os.getenv("SMTP_USER", "")
        self.SMTP_PASS    = os.getenv("SMTP_PASS", "")
        self.APP_BASE_URL = os.getenv("APP_BASE_URL", "")
        self.OLLAMA_API_URL = os.getenv("OLLAMA_API_URL", "http://localhost:11434/api/generate")
        self.OLLAMA_MODEL = os.getenv("OLLAMA_MODEL", "qwen2.5:7b")
        self.C4C_USERNAME = os.getenv("C4C_USERNAME", "")
        self.C4C_PASSWORD = os.getenv("C4C_PASSWORD", "")
        self.SAP_VERIFY_TLS = os.getenv("SAP_VERIFY_TLS", "false").lower() != "false"
        self.SALES_DB_ROOT = os.getenv(
            "APEX_SALES_DB_ROOT",
            os.path.join(tempfile.gettempdir(), "apex_sales_workspaces"),
        )
        self.PROJECT_REGISTRY_DB = os.getenv("APEX_PROJECT_REGISTRY_DB", "")
        self._audit_weak_secrets()

    def _require(self, name: str) -> str:
        val = os.getenv(name, "")
        if not val:
            print(f"[Config] FATAL: Required env var {name!r} is not set.", file=sys.stderr)
            sys.exit(1)
        return val

    def _audit_weak_secrets(self) -> None:
        if self.FLASK_SECRET_KEY in KNOWN_WEAK_SECRETS:
            logger.critical(
                "FLASK_SECRET_KEY is a known weak value — rotate immediately before deploying."
            )