"""
Database configuration environment settings.

These settings control SQLite and SQLCipher database parameters
that must be set before opening the database connection.

Each setting has a canonical env var name (auto-generated from the key,
e.g. db_config.kdf_iterations -> LDR_DB_CONFIG_KDF_ITERATIONS) and an
optional deprecated alias for backward compatibility with older env var
names (e.g. LDR_DB_KDF_ITERATIONS).
"""

from ..env_settings import (
    IntegerSetting,
    EnumSetting,
)


# Database configuration settings
DB_CONFIG_SETTINGS = [
    # Performance settings
    IntegerSetting(
        key="db_config.cache_size_mb",
        description="SQLite cache size in MB",
        min_value=1,
        max_value=10000,
        default=64,
        deprecated_env_var="LDR_DB_CACHE_SIZE_MB",
    ),
    EnumSetting(
        key="db_config.journal_mode",
        description="SQLite journal mode",
        allowed_values={
            "DELETE",
            "TRUNCATE",
            "PERSIST",
            "MEMORY",
            "WAL",
            "OFF",
        },
        default="WAL",
        case_sensitive=False,
        deprecated_env_var="LDR_DB_JOURNAL_MODE",
    ),
    EnumSetting(
        key="db_config.synchronous",
        description="SQLite synchronous mode",
        allowed_values={"OFF", "NORMAL", "FULL", "EXTRA"},
        default="NORMAL",
        case_sensitive=False,
        deprecated_env_var="LDR_DB_SYNCHRONOUS",
    ),
    # Storage settings
    IntegerSetting(
        key="db_config.page_size",
        description="SQLite page size (must be power of 2)",
        min_value=512,
        max_value=65536,
        default=16384,
        deprecated_env_var="LDR_DB_PAGE_SIZE",
    ),
    # Encryption settings
    IntegerSetting(
        key="db_config.kdf_iterations",
        description="Number of KDF iterations for key derivation",
        min_value=1000,
        max_value=1000000,
        default=256000,
        deprecated_env_var="LDR_DB_KDF_ITERATIONS",
    ),
    EnumSetting(
        key="db_config.kdf_algorithm",
        description="Key derivation function algorithm",
        allowed_values={
            "PBKDF2_HMAC_SHA512",
            "PBKDF2_HMAC_SHA256",
            "PBKDF2_HMAC_SHA1",  # DevSkim: ignore DS126858 — backwards compat for existing databases; default is SHA512
        },
        default="PBKDF2_HMAC_SHA512",
        case_sensitive=False,
        deprecated_env_var="LDR_DB_KDF_ALGORITHM",
    ),
    EnumSetting(
        key="db_config.hmac_algorithm",
        description="HMAC algorithm for database integrity",
        allowed_values={
            "HMAC_SHA512",
            "HMAC_SHA256",
            "HMAC_SHA1",  # DevSkim: ignore DS126858 — backwards compat for existing databases; default is SHA512
        },
        default="HMAC_SHA512",
        case_sensitive=False,
        deprecated_env_var="LDR_DB_HMAC_ALGORITHM",
    ),
    # Runtime security settings
    EnumSetting(
        key="db_config.cipher_memory_security",
        description="SQLCipher memory security (ON=clear memory after use + mlock, OFF=faster). ON requires IPC_LOCK in Docker.",
        allowed_values={"ON", "OFF"},
        default="OFF",
        case_sensitive=False,
    ),
]
