"""Production startup validation and helpers."""
from __future__ import annotations

import secrets

from app.core.config import settings

_WEAK_SECRETS = frozenset({
    "",
    "test-secret-key-for-development-only",
    "changeme",
    "secret",
})


def is_production() -> bool:
    env = (settings.environment or "").lower()
    return env in ("production", "prod") and not settings.debug


def validate_production_config() -> None:
    """Fail fast when production is misconfigured."""
    if not is_production():
        return

    errors: list[str] = []

    if settings.secret_key in _WEAK_SECRETS or len(settings.secret_key or "") < 32:
        errors.append("SECRET_KEY must be set to a random string of at least 32 characters")

    if not settings.database_url or "cnperp123" in (settings.database_url or ""):
        errors.append("DATABASE_URL must be set to a strong production database URL")

    if settings.allow_legacy_unlicensed:
        errors.append("ALLOW_LEGACY_UNLICENSED must be false in production")

    if errors:
        raise RuntimeError(
            "Production configuration errors:\n  - " + "\n  - ".join(errors)
        )


def generate_secret_hint() -> str:
    return secrets.token_urlsafe(48)
