"""django_grpc.config.auth — gRPC auth configuration."""

from __future__ import annotations

from typing import Literal

from pydantic import BaseModel, ConfigDict, Field

# A3: Allowlist of secure JWT algorithms. Free-form str accepted "none" and typos silently.
# "none" would bypass signature verification entirely; typos cause all JWT decodes to fail.
JwtAlgorithm = Literal["HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512"]


class GrpcAuthConfig(BaseModel):
    """gRPC JWT auth configuration."""

    model_config = ConfigDict(frozen=True, extra="forbid")

    enabled: bool = Field(default=True)
    require_auth: bool = Field(
        default=False,
        description="False = anonymous access allowed",
    )
    jwt_algorithm: JwtAlgorithm = Field(default="HS256", description="JWT signing algorithm (allowlisted)")
    jwt_expiration_hours: int = Field(default=24, ge=1, le=8760)

    public_methods: list[str] = Field(
        default_factory=list,
        description="Full method paths excluded from auth",
    )


__all__ = ["GrpcAuthConfig"]
