"""应用配置：环境变量优先，秘密不落盘。"""

from functools import lru_cache

from pydantic_settings import BaseSettings, SettingsConfigDict


class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_prefix="HUNJING_", env_file=".env", extra="ignore")

    env: str = "development"
    # 开发档管理员邮箱白名单（逗号分隔）：命中邮箱在首次登录（建户）时即为 admin 角色；
    # 已存在的普通用户不自动提权。正式管理员治理属 WP-14。
    dev_admin_emails: str = ""
    log_level: str = "info"
    api_port: int = 8000
    database_url: str = "postgresql+asyncpg://hunjing:hunjing_dev_password@127.0.0.1:5432/hunjing"
    storage_root: str = "storage"
    sandbox_enabled: bool = False  # 未启用时隔离插件执行 fail-closed


@lru_cache
def get_settings() -> Settings:
    return Settings()