from pydantic_settings import BaseSettings, SettingsConfigDict
from functools import lru_cache


import secrets


class Settings(BaseSettings):
    ENV: str = "development"
    DEBUG: bool = True

    # JWT secret: 生产环境必须通过环境变量设置
    # 若未设置则每次启动随机生成（重启后旧 token 失效）
    SECRET_KEY: str = ""
    ACCESS_TOKEN_EXPIRE_MINUTES: int = 480  # 8小时
    ALGORITHM: str = "HS256"

    DATABASE_URL: str = "sqlite+aiosqlite:///./sqlite3.db"

    ADMIN_USERNAME: str = "admin"
    ADMIN_PASSWORD: str = "123456"

    # CORS: production comma-separated origins (e.g. "https://sql.example.com,https://sql2.example.com")
    CORS_ORIGINS: str = ""

    # 登录频率限制: 每IP每分钟最多尝试次数
    LOGIN_RATE_LIMIT: int = 10

    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8")


@lru_cache()
def get_settings() -> Settings:
    s = Settings()
    if not s.SECRET_KEY:
        s.SECRET_KEY = secrets.token_urlsafe(32)
        if s.ENV == "development":
            import logging
            logging.getLogger(__name__).info("SECRET_KEY 未设置，已自动生成（重启后失效）")
    return s