"""
Django settings for verbrauchsportal project.
Migrated from Laravel – equivalent of config/app.php + config/database.php + config/mail.php
"""

import environ
from pathlib import Path
import os
from decouple import config, Config, RepositoryEnv
# ---------------------------------------------------------------------------
# Paths
# ---------------------------------------------------------------------------
BASE_DIR = Path(__file__).resolve().parent.parent

# ---------------------------------------------------------------------------
# Environment variables (.env)
# ---------------------------------------------------------------------------
env_file_path = os.environ.get('ENV_FILE') # Für LIVE und SANDBOX System # Pfad zur .venv-Datei aus den Umgebungsvariablen abrufen
if env_file_path:
    # Erstelle eine Instanz von Config und RepositoryEnv mit dem angegebenen Pfad
    config = Config(RepositoryEnv(env_file_path))


# ---------------------------------------------------------------------------
# Security
# ---------------------------------------------------------------------------
SECRET_KEY = config('SECRET_KEY', default='django-insecure-change-me-in-production')
DEBUG = config("APP_DEBUG", default=False, cast=bool)
AllowedHostsList = config("ALLOWED_HOSTS").split(",")
ALLOWED_HOSTS = AllowedHostsList

# ---------------------------------------------------------------------------
# Custom User Model  (must be set before installed apps)
# ---------------------------------------------------------------------------
AUTH_USER_MODEL = 'app_nutzer.User'

AUTHENTICATION_BACKENDS = [
    'app_admin.backends.AdminUserBackend',          # erst AdminUser prüfen
    'django.contrib.auth.backends.ModelBackend',  # dann normale User
]

# ---------------------------------------------------------------------------
# Installed Apps
# ---------------------------------------------------------------------------
INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    # Third-party
    'rest_framework',
    
    'corsheaders',
    # Local – domain apps
    'app_nutzer',
    'app_real_estate',
    'app_api',
    'app_verbrauch',
    'app_admin',
    # Local – shared
    'core',
]

# ---------------------------------------------------------------------------
# Middleware
# ---------------------------------------------------------------------------
MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'whitenoise.middleware.WhiteNoiseMiddleware',
    'corsheaders.middleware.CorsMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    # Custom – migrated from Laravel SecureHeaders middleware
    'core.middleware.SecureHeadersMiddleware',
    'core.middleware.IPAddressRestrictionMiddleware',
    'core.middleware.NutzerBesuchMiddleware',
    
]

ROOT_URLCONF = 'verbrauchsportal.urls'

# ---------------------------------------------------------------------------
# Templates
# ---------------------------------------------------------------------------
TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [BASE_DIR / 'core' / 'templates'],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
                'core.context_processors.navbar_context',
            ],
        },
    },
]

WSGI_APPLICATION = 'verbrauchsportal.wsgi.application'

# ---------------------------------------------------------------------------
# Database – MySQL via mysql-connector-python
# ---------------------------------------------------------------------------
DATABASES = {
    'default': {
        'ENGINE': 'mysql.connector.django',
        'NAME': config('DB_DATABASE', default='verbrauchsportal'),
        'USER': config('DB_USERNAME', default='root'),
        'PASSWORD': config('DB_PASSWORD', default=''),
        'HOST': config('DB_HOST', default='127.0.0.1'),
        'PORT': config('DB_PORT', default='3306'),
        'OPTIONS': {
            'charset': 'utf8mb4',
        },
    }
}

# Test-DB auf echte DB setzen (kein CREATE DATABASE nötig)
import sys
if 'pytest' in sys.modules:
    DATABASES['default']['TEST'] = {
        'NAME': 'test_verbrauchsportal', 
    }

# ---------------------------------------------------------------------------
# Authentication
# ---------------------------------------------------------------------------
AUTH_PASSWORD_VALIDATORS = [
    {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},
    {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator'},
    {'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'},
    {'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},
]

LOGIN_URL = '/login'
LOGIN_REDIRECT_URL = '/'
LOGOUT_REDIRECT_URL = '/login'

# ---------------------------------------------------------------------------
# Django REST Framework
# ---------------------------------------------------------------------------
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'app_admin.authentication.AdminTokenAuthentication',
        # 'rest_framework.authentication.TokenAuthentication',
        'rest_framework.authentication.SessionAuthentication',
    ],
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
    ],
    'EXCEPTION_HANDLER': 'core.exception_handler.api_exception_handler',
}

# ---------------------------------------------------------------------------
# CORS – migrated from config/cors.php (paths: api/*)
# ---------------------------------------------------------------------------
CORS_URLS_REGEX = r'^/api/.*$'
CORS_ALLOW_ALL_ORIGINS = True


# Zielverzeichnis fuer das Fehler-Log. Ueber LOG_DIR konfigurierbar, damit es
# auf dem Server ausserhalb des Repos liegen kann.
LOG_DIR = Path(config('LOG_DIR', default=str(BASE_DIR / 'logs')))


def _logverzeichnis_nutzbar(pfad):
    """True, wenn der laufende Prozess dort schreiben darf.

    Unter Apache/mod_wsgi laeuft der Prozess als www-data und darf im
    Deployment-Verzeichnis in der Regel NICHT anlegen oder schreiben. Ein
    Datei-Handler, der sich nicht oeffnen laesst, bringt logging.dictConfig
    zum Werfen -- und das passiert in django.setup(), also noch bevor
    irgendeine View laeuft. Der gesamte Dienst waere unten. Deshalb wird die
    Schreibbarkeit hier geprueft und der Handler im Zweifel weggelassen.
    """
    try:
        pfad.mkdir(parents=True, exist_ok=True)
    except OSError:
        return False
    return os.access(pfad, os.W_OK)


LOG_DATEI_AKTIV = _logverzeichnis_nutzbar(LOG_DIR)

LOGGING = {
    "version": 1,
    "disable_existing_loggers": False,
    "formatters": {
        "verbose": {
            "format": "{asctime} {levelname} {name} {message}",
            "style": "{",
        },
    },
    "handlers": {
        # Geht unter Apache/mod_wsgi ins Apache-Errorlog -- dort stehen die
        # Tracebacks also in jedem Fall.
        "console": {"class": "logging.StreamHandler", "formatter": "verbose"},
    },
    "root": {"handlers": ["console"], "level": "INFO"},
    "loggers": {
        # Django loggt hier jeden 500er inkl. vollem Traceback
        "django.request": {
            "handlers": ["console"],
            "level": "ERROR",
            "propagate": False,
        },
        # unbehandelte Exceptions aus DRF-Views (core.exception_handler)
        "api.errors": {
            "handlers": ["console"],
            "level": "ERROR",
            "propagate": False,
        },
    },
}

if LOG_DATEI_AKTIV:
    # Zusaetzliche Datei nur, wenn sie sich auch oeffnen laesst.
    LOGGING["handlers"]["errorfile"] = {
        "class": "logging.handlers.RotatingFileHandler",
        "filename": str(LOG_DIR / "django-errors.log"),
        "maxBytes": 5 * 1024 * 1024,
        "backupCount": 3,
        "encoding": "utf-8",
        "formatter": "verbose",
        "level": "ERROR",
        "delay": True,      # Datei erst beim ersten Fehler anfassen
    }
    for _logger in ("django.request", "api.errors"):
        LOGGING["loggers"][_logger]["handlers"].append("errorfile")

# ---------------------------------------------------------------------------
# Internationalisation – migrated from config/app.php (locale: de, timezone: Europe/Berlin)
# ---------------------------------------------------------------------------
LANGUAGE_CODE = 'de-de'
TIME_ZONE = 'Europe/Berlin'
USE_I18N = True
USE_TZ = True

# ---------------------------------------------------------------------------
# Static files
# ---------------------------------------------------------------------------
STATIC_URL = '/static/'
STATIC_ROOT = config('STATIC_ROOT', default='/home/test/temp')
STATICFILES_DIRS = [BASE_DIR / 'static']
STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'

# ---------------------------------------------------------------------------
# Media files
# ---------------------------------------------------------------------------
MEDIA_URL = '/media/'
MEDIA_ROOT = BASE_DIR / 'media'

# ---------------------------------------------------------------------------
# Default primary key field type
# ---------------------------------------------------------------------------
DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'

# ---------------------------------------------------------------------------
# Email
# ---------------------------------------------------------------------------
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
EMAIL_HOST = config('EMAIL_HOSTNAME', default='smtp.mailgun.org')  # Django braucht EMAIL_HOST
EMAIL_PORT = config('EMAIL_PORT', default=587, cast=int)
EMAIL_USE_TLS = False
EMAIL_USE_SSL = True  # Port 465 braucht SSL
EMAIL_HOST_USER = config('EMAIL_USERNAME', default='')
EMAIL_HOST_PASSWORD = config('EMAIL_PASSWORD', default='')
DEFAULT_FROM_EMAIL = config('EMAIL_USERNAME', default='')
 

# ---------------------------------------------------------------------------
# Security headers (supplement to SecureHeadersMiddleware)
# ---------------------------------------------------------------------------
SECURE_CONTENT_TYPE_NOSNIFF = False   # Disabled – same as Laravel config comment
X_FRAME_OPTIONS = 'DENY'
SECURE_BROWSER_XSS_FILTER = True