"""Process-wide configuration loaded from environment (`.env`).

Everything that varies between deployments (creds, paths, ports) lives
here. User-facing agent/MCP/frontend definitions live in ``config_path``
and are loaded by :mod:`beaver_gateway.config`.
"""

from __future__ import annotations

from pathlib import Path

from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    """Runtime environment for the gateway process."""

    model_config = SettingsConfigDict(
        env_file=".env", env_file_encoding="utf-8", extra="ignore"
    )

    database_url: str
    """SQLAlchemy async URL for the gateway's database."""

    admin_user: str
    """Username for the admin UI login."""

    admin_pass: str
    """Password for the admin UI login."""

    session_secret: str
    """Secret used to sign admin UI session cookies."""

    internal_mcp_port: int = 8765
    """Port the gateway's own internal MCP server listens on."""

    config_path: Path = Path("/config/config.py")
    """Where the user-facing agent/MCP/frontend config module lives."""

    claude_runner_user: str | None = None
    """Unix user the claude subprocess runs as. Needs the gateway to be root."""

    claude_home: Path | None = None
    """``HOME`` for the claude subprocess (its ``~/.claude`` lives there)."""

    raycast_bearer: str | None = None
    """Bearer token the gateway presents to the Raycast API."""

    raycast_config_path: Path = Path("/config/raycast.json")
    """Where cached Raycast API config (fetched on first use) is stored."""

    raycast_device_id: str | None = None
    """Stable per-install id (``secrets.token_hex(32)``); required when any
    ``RaycastAgent`` is configured, so restarts don't look like a new device."""

    raycast_locale: str = "en-US"
    """``Accept-Language`` sent to the Raycast API and the default locale for
    auto ``UserPreferences``. One value per gateway (one shared Client)."""

    send_file_roots: str = "/mnt/hole/shared"
    """Directories the ``send_file`` tool may read, separated by ``:``. A
    frontend always adds the inbox its own attachments land in."""

    secrets_key: str | None = None
    """Hex AES-256 key (``openssl rand -hex 32``) sealing the secrets table;
    unset leaves secrets off. Never reaches the model's environment."""

    secrets_socket: Path = Path("/run/beaver-secrets/gateway.sock")
    """Root-only socket the ``secret`` helper reads values from."""

    bootstrap_tokens: str = ""
    """Out-of-band token seed: ``name1:value1,name2:value2``. Layers
    alongside DB-issued tokens; used for first-run setup and recovery."""