syndarix/backend/app/core/config.py

from pydantic_settings import BaseSettings
from typing import Optional, List
from pydantic import Field, field_validator
import logging


class Settings(BaseSettings):
    PROJECT_NAME: str = "App"
    VERSION: str = "1.0.0"
    API_V1_STR: str = "/api/v1"

    # Environment (must be before SECRET_KEY for validation)
    ENVIRONMENT: str = Field(
        default="development",
        description="Environment: development, staging, or production"
    )

    # Database configuration
    POSTGRES_USER: str = "postgres"
    POSTGRES_PASSWORD: str = "postgres"
    POSTGRES_HOST: str = "localhost"
    POSTGRES_PORT: str = "5432"
    POSTGRES_DB: str = "app"
    DATABASE_URL: Optional[str] = None
    REFRESH_TOKEN_EXPIRE_DAYS: int = 60
    db_pool_size: int = 20  # Default connection pool size
    db_max_overflow: int = 50  # Maximum overflow connections
    db_pool_timeout: int = 30  # Seconds to wait for a connection
    db_pool_recycle: int = 3600  # Recycle connections after 1 hour

    # SQL debugging (disable in production)
    sql_echo: bool = False  # Log SQL statements
    sql_echo_pool: bool = False  # Log connection pool events
    sql_echo_timing: bool = False  # Log query execution times
    slow_query_threshold: float = 0.5  # Log queries taking longer than this

    @property
    def database_url(self) -> str:
        """
        Get the SQLAlchemy database URL.
        If DATABASE_URL is explicitly set, use that.
        Otherwise, construct from components.
        """
        if self.DATABASE_URL:
            return self.DATABASE_URL
        self.DATABASE_URL = f"postgresql://{self.POSTGRES_USER}:{self.POSTGRES_PASSWORD}@{self.POSTGRES_HOST}:{self.POSTGRES_PORT}/{self.POSTGRES_DB}"
        return self.DATABASE_URL

    # JWT configuration
    SECRET_KEY: str = Field(
        default="your_secret_key_here",
        min_length=32,
        description="JWT signing key. MUST be changed in production. Generate with: python -c 'import secrets; print(secrets.token_urlsafe(32))'"
    )
    ALGORITHM: str = "HS256"
    ACCESS_TOKEN_EXPIRE_MINUTES: int = 15  # 15 minutes (production standard)
    REFRESH_TOKEN_EXPIRE_DAYS: int = 7  # 7 days

    # CORS configuration
    BACKEND_CORS_ORIGINS: List[str] = ["http://localhost:3000"]

    # Admin user
    FIRST_SUPERUSER_EMAIL: Optional[str] = Field(
        default=None,
        description="Email for first superuser account"
    )
    FIRST_SUPERUSER_PASSWORD: Optional[str] = Field(
        default=None,
        description="Password for first superuser (min 12 characters)"
    )

    @field_validator('SECRET_KEY')
    @classmethod
    def validate_secret_key(cls, v: str, info) -> str:
        """Validate SECRET_KEY is secure, especially in production."""
        # Get environment from values if available
        values_data = info.data if info.data else {}
        env = values_data.get('ENVIRONMENT', 'development')

        if v.startswith("your_secret_key_here"):
            if env == "production":
                raise ValueError(
                    "SECRET_KEY must be set to a secure random value in production. "
                    "Generate one with: python -c 'import secrets; print(secrets.token_urlsafe(32))'"
                )
            # Warn in development but allow
            logger = logging.getLogger(__name__)
            logger.warning(
                "⚠️  Using default SECRET_KEY. This is ONLY acceptable in development. "
                "Generate a secure key with: python -c 'import secrets; print(secrets.token_urlsafe(32))'"
            )

        if len(v) < 32:
            raise ValueError("SECRET_KEY must be at least 32 characters long for security")

        return v

    @field_validator('FIRST_SUPERUSER_PASSWORD')
    @classmethod
    def validate_superuser_password(cls, v: Optional[str]) -> Optional[str]:
        """Validate superuser password strength."""
        if v is None:
            return v

        if len(v) < 12:
            raise ValueError("FIRST_SUPERUSER_PASSWORD must be at least 12 characters")

        # Check for common weak passwords
        weak_passwords = {'admin123', 'Admin123', 'password123', 'Password123', '123456789012'}
        if v in weak_passwords:
            raise ValueError(
                "FIRST_SUPERUSER_PASSWORD is too weak. "
                "Use a strong, unique password with mixed case, numbers, and symbols."
            )

        # Basic strength check
        has_lower = any(c.islower() for c in v)
        has_upper = any(c.isupper() for c in v)
        has_digit = any(c.isdigit() for c in v)

        if not (has_lower and has_upper and has_digit):
            raise ValueError(
                "FIRST_SUPERUSER_PASSWORD must contain lowercase, uppercase, and digits"
            )

        return v

    model_config = {
        "env_file": "../.env",
        "env_file_encoding": "utf-8",
        "case_sensitive": True,
        "extra": "ignore"  # Ignore extra fields from .env (e.g., frontend-specific vars)
    }


settings = Settings()