"""Authentication configuration.

⚠️ AUTO-GENERATED BY PRISM - DO NOT EDIT
Settings for JWT sessions, email, OAuth, and security.
"""

from __future__ import annotations

from functools import lru_cache

from pydantic_settings import BaseSettings, SettingsConfigDict


class AuthSettings(BaseSettings):
    """Authentication settings loaded from environment variables."""

    model_config = SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
    )

    # JWT secret for self-issued session tokens
    jwt_secret: str = "change-me-in-production"

    # Session Configuration
    session_cookie_name: str = "{{ session_cookie_name }}"
    session_max_age: int = {{ session_max_age_seconds }}
{% if has_email_features %}

    # Email (Resend)
    resend_api_key: str = ""
    email_from: str = "{{ email_from }}"
    frontend_url: str = "http://localhost:5173"
{% endif %}
{% if account_lockout %}

    # Account lockout
    max_failed_login_attempts: int = {{ max_failed_attempts }}
    lockout_duration_minutes: int = {{ lockout_duration_minutes }}
{% endif %}
{% if email_verification %}

    # Token expiry
    email_verification_token_hours: int = {{ email_verification_token_hours }}
{% endif %}
{% if password_reset %}
    password_reset_token_hours: int = {{ password_reset_token_hours }}
{% endif %}
{% for provider in oauth_providers %}
{% if provider.provider == "github" %}

    # GitHub OAuth
    github_client_id: str = ""
    github_client_secret: str = ""
    github_redirect_uri: str = ""
{% endif %}
{% if provider.provider == "google" %}

    # Google OAuth
    google_client_id: str = ""
    google_client_secret: str = ""
    google_redirect_uri: str = ""
{% endif %}
{% endfor %}


@lru_cache
def get_auth_settings() -> AuthSettings:
    """Get cached auth settings."""
    return AuthSettings()


auth_settings = get_auth_settings()
