"""Authentication configuration via Pydantic settings."""

from pydantic_settings import BaseSettings


class AuthSettings(BaseSettings):
    """Conduit auth configuration, loaded from environment variables.

    Required:
        ENTRA_CLIENT_ID: App registration client ID from Azure portal.

    Optional:
        ENTRA_TENANT_ID: Set to "common" for multi-tenant (default).
            Use a specific tenant GUID to restrict to a single tenant.
        ENTRA_AUDIENCE: Token audience to validate. Defaults to ENTRA_CLIENT_ID.
        JWKS_URI: Microsoft's JWKS key endpoint. Override only for testing.
        JWKS_CACHE_TTL: How long to cache JWKS keys (seconds). Default 1 hour.
        AUTH_DISABLED: Set True for local dev to bypass validation entirely.
        AUTH_EXCLUDE_PATHS: Paths that skip auth (health checks, etc).
    """

    ENTRA_CLIENT_ID: str
    ENTRA_TENANT_ID: str = "common"
    ENTRA_AUDIENCE: str | None = None
    JWKS_URI: str = (
        "https://login.microsoftonline.com/common/discovery/v2.0/keys"
    )
    JWKS_CACHE_TTL: int = 3600
    AUTH_DISABLED: bool = False
    AUTH_EXCLUDE_PATHS: list[str] = ["/health", "/api/health"]

    model_config = {"env_prefix": "", "env_file": ".env"}
