"""Paramètres Django du template : origine + port composés automatiquement."""
from pathlib import Path
from decouple import config
from .origins import csv_values, effective_origins

BASE_DIR = Path(__file__).resolve().parent.parent

SECRET_KEY = config("SECRET_KEY", default="")
if not SECRET_KEY:
    raise RuntimeError("SECRET_KEY est vide : renseigne SECRET_KEY dans le fichier .env")
DEBUG = config("DEBUG", default=False, cast=bool)

FRONTEND_PORT = config("FRONTEND_PORT", default=1028, cast=int)
BACKEND_PORT = config("BACKEND_PORT", default=1029, cast=int)
ALLOWED_HOSTS = csv_values(config("ALLOWED_HOSTS", default="localhost,127.0.0.1"))

# http://localhost -> http://localhost:FRONTEND_PORT pour CORS
CORS_ALLOWED_ORIGINS = effective_origins(
    config("CORS_ALLOWED_ORIGINS", default="http://localhost"),
    FRONTEND_PORT,
    auto_port=config("AUTO_PORT_CORS", default=True, cast=bool),
)

# http://localhost -> http://localhost:BACKEND_PORT pour CSRF
_csrf_backend = effective_origins(
    config("CSRF_TRUSTED_ORIGINS", default="http://localhost"),
    BACKEND_PORT,
    auto_port=config("AUTO_PORT_CSRF", default=True, cast=bool),
)
# Ajoute également l'origine du frontend : nécessaire aux requêtes CSRF
# de l'interface (par exemple lorsque Django Admin est exposé via le proxy).
CSRF_TRUSTED_ORIGINS = list(dict.fromkeys([*_csrf_backend, *CORS_ALLOWED_ORIGINS]))

INSTALLED_APPS = [
    "django.contrib.admin",
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "django.contrib.staticfiles",
    "rest_framework",
    "corsheaders",
    "common",
]

MIDDLEWARE = [
    "corsheaders.middleware.CorsMiddleware",
    "django.middleware.security.SecurityMiddleware",
    "whitenoise.middleware.WhiteNoiseMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
]

ROOT_URLCONF = "core.urls"
TEMPLATES = [{
    "BACKEND": "django.template.backends.django.DjangoTemplates",
    "DIRS": [],
    "APP_DIRS": True,
    "OPTIONS": {
        "context_processors": [
            "django.template.context_processors.debug",
            "django.template.context_processors.request",
            "django.contrib.auth.context_processors.auth",
            "django.contrib.messages.context_processors.messages",
        ]
    },
}]
WSGI_APPLICATION = "core.wsgi.application"
ASGI_APPLICATION = "core.asgi.application"

DATABASES = {
    "default": {
        "ENGINE": "django.db.backends.mysql",
        "NAME": config("MYSQL_DATABASE"),
        "USER": config("MYSQL_USER"),
        "PASSWORD": config("MYSQL_PASSWORD"),
        "HOST": config("MYSQL_HOST", default="db"),
        "PORT": config("MYSQL_PORT", default=3306, cast=int),
        "OPTIONS": {"charset": "utf8mb4"},
        "CONN_MAX_AGE": 60,
    }
}

AUTH_PASSWORD_VALIDATORS = [
    {"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"},
    {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"},
    {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"},
    {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
]

REST_FRAMEWORK = {
    "DEFAULT_PERMISSION_CLASSES": ["rest_framework.permissions.IsAuthenticated"],
}

LANGUAGE_CODE = "fr-fr"
TIME_ZONE = "Europe/Paris"
USE_I18N = True
USE_TZ = True

STATIC_URL = "/static/"
STATIC_ROOT = BASE_DIR / "staticfiles"
STORAGES = {
    "staticfiles": {"BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage"},
}
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = "Lax"
CSRF_COOKIE_SAMESITE = "Lax"
SESSION_COOKIE_SECURE = config("SESSION_COOKIE_SECURE", default=False, cast=bool)
CSRF_COOKIE_SECURE = config("CSRF_COOKIE_SECURE", default=False, cast=bool)
SECURE_CONTENT_TYPE_NOSNIFF = True