"""Paramètres Django du template : origine + port composés automatiquement."""
from pathlib import Path
from decouple import config
from .origins import csv_values, effective_origins

BASE_DIR = Path(__file__).resolve().parent.parent

SECRET_KEY = config("SECRET_KEY", default="")
if not SECRET_KEY:
    raise RuntimeError("SECRET_KEY est vide : renseigne SECRET_KEY dans le fichier .env")
DEBUG = config("DEBUG", default=False, cast=bool)

FRONTEND_PORT = config("FRONTEND_PORT", default=1036, cast=int)
BACKEND_PORT = config("BACKEND_PORT", default=1037, cast=int)
ALLOWED_HOSTS = csv_values(config("ALLOWED_HOSTS", default="localhost,127.0.0.1,backend"))

# http://localhost -> http://localhost:FRONTEND_PORT pour CORS
CORS_ALLOWED_ORIGINS = effective_origins(
    config("CORS_ALLOWED_ORIGINS", default="http://localhost"),
    FRONTEND_PORT,
    auto_port=config("AUTO_PORT_CORS", default=True, cast=bool),
)
CORS_ALLOWED_ORIGINS = list(dict.fromkeys([*csv_values(config("CORS_ALLOWED_ORIGINS", default="http://localhost")), *CORS_ALLOWED_ORIGINS]))

# http://localhost -> http://localhost:BACKEND_PORT pour CSRF
_csrf_backend = effective_origins(
    config("CSRF_TRUSTED_ORIGINS", default="http://localhost"),
    BACKEND_PORT,
    auto_port=config("AUTO_PORT_CSRF", default=True, cast=bool),
)
# Ajoute également l'origine du frontend : nécessaire aux requêtes CSRF
# du tableau de bord React utilisant les sessions Django.
# Conserver aussi les domaines en HTTPS sans numéro de port (proxy inverse 443).
# Le composeur de ports est utile en local mais ne doit pas casser le domaine public.
CSRF_TRUSTED_ORIGINS = list(dict.fromkeys([
    *csv_values(config("CSRF_TRUSTED_ORIGINS", default="http://localhost")),
    *_csrf_backend,
    *csv_values(config("CORS_ALLOWED_ORIGINS", default="http://localhost")),
    *CORS_ALLOWED_ORIGINS,
]))

INSTALLED_APPS = [
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "django.contrib.staticfiles",
    "rest_framework",
    "corsheaders",
    "common",
    "users",
    "education",
]

MIDDLEWARE = [
    "corsheaders.middleware.CorsMiddleware",
    "django.middleware.security.SecurityMiddleware",
    "whitenoise.middleware.WhiteNoiseMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
]

ROOT_URLCONF = "core.urls"
TEMPLATES = [{
    "BACKEND": "django.template.backends.django.DjangoTemplates",
    "DIRS": [],
    "APP_DIRS": True,
    "OPTIONS": {
        "context_processors": [
            "django.template.context_processors.debug",
            "django.template.context_processors.request",
            "django.contrib.auth.context_processors.auth",
            "django.contrib.messages.context_processors.messages",
        ]
    },
}]
WSGI_APPLICATION = "core.wsgi.application"
ASGI_APPLICATION = "core.asgi.application"

DATABASES = {
    "default": {
        "ENGINE": "django.db.backends.mysql",
        "NAME": config("MYSQL_DATABASE"),
        "USER": config("MYSQL_USER"),
        "PASSWORD": config("MYSQL_PASSWORD"),
        "HOST": config("MYSQL_HOST", default="db"),
        "PORT": config("MYSQL_PORT", default=3306, cast=int),
        "OPTIONS": {"charset": "utf8mb4"},
        "CONN_MAX_AGE": 60,
    }
}

AUTH_PASSWORD_VALIDATORS = [
    {"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"},
    {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"},
    {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"},
    {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
]

REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES": ["rest_framework.authentication.SessionAuthentication"],
    "DEFAULT_PERMISSION_CLASSES": ["rest_framework.permissions.IsAuthenticated"],
}

LANGUAGE_CODE = "fr-fr"
TIME_ZONE = "Europe/Paris"
USE_I18N = True
USE_TZ = True

STATIC_URL = "/static/"
STATIC_ROOT = BASE_DIR / "staticfiles"
STORAGES = {
    "staticfiles": {"BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage"},
}
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = "Lax"
CSRF_COOKIE_SAMESITE = "Lax"
SESSION_COOKIE_SECURE = config("SESSION_COOKIE_SECURE", default=False, cast=bool)
CSRF_COOKIE_SECURE = config("CSRF_COOKIE_SECURE", default=False, cast=bool)
SECURE_CONTENT_TYPE_NOSNIFF = True

# Les images du CMS survivent aux redéploiements (volume Docker).
MEDIA_ROOT = BASE_DIR / "media"
MEDIA_URL = "/media/"

# Conserve le modèle utilisateur AccroCBio et ses migrations existantes.
AUTH_USER_MODEL = 'users.User'
CONTACT_NOTIFICATION_EMAIL = config('CONTACT_NOTIFICATION_EMAIL', default='')
DEFAULT_FROM_EMAIL = config('DEFAULT_FROM_EMAIL', default='no-reply@localhost')
EMAIL_HOST = config('EMAIL_HOST', default='localhost')
EMAIL_PORT = config('EMAIL_PORT', default=25, cast=int)
EMAIL_HOST_USER = config('EMAIL_HOST_USER', default='')
EMAIL_HOST_PASSWORD = config('EMAIL_HOST_PASSWORD', default='')
EMAIL_USE_TLS = config('EMAIL_USE_TLS', default=False, cast=bool)
REST_FRAMEWORK['DEFAULT_THROTTLE_RATES'] = {'contact': '5/hour'}

# Réserver les routes déjà utilisées par le site pédagogique.
CMS_RESERVED_SLUGS = {"presentation", "services-a-la-personne", "credit-impot", "ressources", "contact", "avis", "offre-de-rentree", "mentions-legales", "confidentialite"}