"""Default settings for the ECP Auth package.

These settings can be overridden in the Django project's ``settings.py``
by defining the corresponding variables with the ``ECP_AUTH_`` prefix.

Example:
    In your Django ``settings.py``::

        ECP_AUTH_CHALLENGE_TIMEOUT = 600  # 10 minutes
        ECP_AUTH_REQUIRE_KEY_USAGE = True
"""

from typing import Any

from django.conf import settings


# --- Default Configuration Values ---

#: Timeout for challenge nonces in seconds (default: 5 minutes).
DEFAULT_CHALLENGE_TIMEOUT: int = 300

#: Length of the challenge nonce in bytes (default: 32 bytes = 256 bits).
DEFAULT_CHALLENGE_LENGTH: int = 32

#: Whether to require the digitalSignature key usage extension.
DEFAULT_REQUIRE_KEY_USAGE: bool = True

#: Whether to validate the certificate chain against trusted CAs.
DEFAULT_VALIDATE_CHAIN: bool = False

#: Path to a directory containing trusted CA certificates (PEM format).
DEFAULT_TRUSTED_CA_DIR: str = ""

#: Supported signature algorithms.
DEFAULT_SUPPORTED_ALGORITHMS: list[str] = [
    "sha256_rsa",
    "sha384_rsa",
    "sha512_rsa",
    "sha256_ecdsa",
    "sha384_ecdsa",
    "sha512_ecdsa",
]

#: URL to redirect to after successful login.
DEFAULT_LOGIN_REDIRECT_URL: str = "/"

#: URL to redirect to after logout.
DEFAULT_LOGOUT_REDIRECT_URL: str = "/auth/login/"

#: Whether to allow self-signed certificates (for development/testing).
DEFAULT_ALLOW_SELF_SIGNED: bool = True

#: Session key prefix for ECP data.
DEFAULT_SESSION_KEY_PREFIX: str = "ecp_auth_"


def get_setting(name: str, default: Any = None) -> Any:
    """Retrieve an ECP Auth setting with fallback to default.

    Looks for the setting in Django's settings module with the
    ``ECP_AUTH_`` prefix. Falls back to the provided default value.

    Args:
        name: Setting name without the ``ECP_AUTH_`` prefix.
        default: Fallback value if the setting is not defined.

    Returns:
        The setting value from Django settings or the default.

    Example:
        >>> get_setting("CHALLENGE_TIMEOUT", 300)
        300
    """
    return getattr(settings, f"ECP_AUTH_{name}", default)


def get_challenge_timeout() -> int:
    """Get the challenge nonce timeout in seconds.

    Returns:
        Timeout value in seconds.
    """
    return get_setting("CHALLENGE_TIMEOUT", DEFAULT_CHALLENGE_TIMEOUT)


def get_challenge_length() -> int:
    """Get the challenge nonce length in bytes.

    Returns:
        Nonce length in bytes.
    """
    return get_setting("CHALLENGE_LENGTH", DEFAULT_CHALLENGE_LENGTH)


def get_require_key_usage() -> bool:
    """Check if digitalSignature key usage is required.

    Returns:
        True if key usage validation is required.
    """
    return get_setting("REQUIRE_KEY_USAGE", DEFAULT_REQUIRE_KEY_USAGE)


def get_validate_chain() -> bool:
    """Check if certificate chain validation is enabled.

    Returns:
        True if chain validation is enabled.
    """
    return get_setting("VALIDATE_CHAIN", DEFAULT_VALIDATE_CHAIN)


def get_trusted_ca_dir() -> str:
    """Get the path to the trusted CA certificates directory.

    Returns:
        Path to the CA certificates directory.
    """
    return get_setting("TRUSTED_CA_DIR", DEFAULT_TRUSTED_CA_DIR)


def get_supported_algorithms() -> list[str]:
    """Get the list of supported signature algorithms.

    Returns:
        List of algorithm identifiers.
    """
    return get_setting("SUPPORTED_ALGORITHMS", DEFAULT_SUPPORTED_ALGORITHMS)


def get_login_redirect_url() -> str:
    """Get the URL to redirect to after successful login.

    Returns:
        Redirect URL string.
    """
    return get_setting("LOGIN_REDIRECT_URL", DEFAULT_LOGIN_REDIRECT_URL)


def get_logout_redirect_url() -> str:
    """Get the URL to redirect to after logout.

    Returns:
        Redirect URL string.
    """
    return get_setting("LOGOUT_REDIRECT_URL", DEFAULT_LOGOUT_REDIRECT_URL)


def get_allow_self_signed() -> bool:
    """Check if self-signed certificates are allowed.

    Returns:
        True if self-signed certificates are permitted.
    """
    return get_setting("ALLOW_SELF_SIGNED", DEFAULT_ALLOW_SELF_SIGNED)


def get_session_key_prefix() -> str:
    """Get the session key prefix for ECP data.

    Returns:
        Session key prefix string.
    """
    return get_setting("SESSION_KEY_PREFIX", DEFAULT_SESSION_KEY_PREFIX)
