"""
Security environment settings.

These settings control security-related behavior like SSRF validation
and CORS origin restrictions.
"""

import os
from ..env_settings import BooleanSetting, StringSetting


# External environment variables (set by pytest, CI systems)
# These are read directly since we don't control them
PYTEST_CURRENT_TEST = os.environ.get("PYTEST_CURRENT_TEST")


# LDR Security settings (our application's security configuration)
SECURITY_SETTINGS = [
    StringSetting(
        key="security.cors.allowed_origins",
        description=(
            "Allowed CORS origins for API routes (comma-separated). "
            "Use '*' for all origins, empty for same-origin only. "
            "Example: 'https://example.com,https://app.example.com'"
        ),
        default=None,
    ),
    StringSetting(
        key="security.websocket.allowed_origins",
        description=(
            "Allowed origins for WebSocket/Socket.IO connections (comma-separated). "
            "Unset or empty means same-origin only (default); use '*' to allow all origins. "
            "Example: 'https://example.com,https://app.example.com'"
        ),
        default=None,
    ),
    BooleanSetting(
        key="notifications.allow_private_ips",
        description=(
            "Allow notification webhooks to target private/local IP addresses. "
            "Environment-only to prevent SSRF bypass via the user-writable settings API. "
            "Only enable this if your notification endpoints are on a trusted local network."
        ),
        default=False,
    ),
    BooleanSetting(
        key="security.allow_nat64",
        description=(
            "Allow outbound traffic to NAT64 prefixes (64:ff9b::/96 RFC 6052 "
            "well-known and 64:ff9b:1::/48 RFC 8215 local-use). Disabled by "
            "default to close the IPv6-wrapped SSRF bypass class — on hosts "
            "configured with NAT64 routes, attacker-supplied URLs can wrap "
            "cloud-metadata or RFC1918 destinations through these prefixes. "
            "Enable only on IPv6-only deployments (DNS64+NAT64) where "
            "outbound IPv4 traffic is synthesized through this prefix and "
            "the operator has accepted the residual SSRF risk. 6to4 "
            "(2002::/16), Teredo (2001::/32), and the discard prefix "
            "(100::/64) remain unconditionally blocked because they have no "
            "live legitimate use in 2026. The cloud-metadata block "
            "(ALWAYS_BLOCKED_METADATA_IPS) still applies via embedded-IPv4 "
            "extraction — see SECURITY.md."
        ),
        default=False,
    ),
    BooleanSetting(
        key="notifications.allow_outbound",
        description=(
            "Master switch for outbound notification webhooks (Apprise). "
            "Disabled by default because Apprise re-resolves DNS at send time, "
            "leaving a DNS-rebinding TOCTOU window that cannot be closed in code "
            "(Apprise exposes no Session/DNS hook). See SECURITY.md "
            "'Notification Webhook SSRF' for details. Set to true only after "
            "reviewing the residual risk. Distinct from the per-user "
            "notifications.enabled toggle in the settings UI: this is the "
            "server-level operator gate, env-only so it cannot be flipped via "
            "the user-writable settings API."
        ),
        default=False,
    ),
]
