"""
Security environment settings.

These settings control security-related behavior like SSRF validation
and CORS origin restrictions.
"""

import os
from ..env_settings import StringSetting


# External environment variables (set by pytest, CI systems)
# These are read directly since we don't control them
PYTEST_CURRENT_TEST = os.environ.get("PYTEST_CURRENT_TEST")


# LDR Security settings (our application's security configuration)
SECURITY_SETTINGS = [
    StringSetting(
        key="security.cors.allowed_origins",
        description=(
            "Allowed CORS origins for API routes (comma-separated). "
            "Use '*' for all origins, empty for same-origin only. "
            "Example: 'https://example.com,https://app.example.com'"
        ),
        default=None,
    ),
    StringSetting(
        key="security.websocket.allowed_origins",
        description=(
            "Allowed origins for WebSocket/Socket.IO connections (comma-separated). "
            "Use '*' for all origins (default), empty for same-origin only. "
            "Example: 'https://example.com,https://app.example.com'"
        ),
        default=None,
    ),
]
