from pydantic import Field, field_validator
from pydantic_settings import BaseSettings


class AppSettings(BaseSettings):
    """Validated application settings from environment variables."""

    # Required secrets
    jwt_secret_key: str = Field(min_length=32)
    database_url: str = Field(pattern=r"^postgresql://")
    backend_api_key: str = Field(min_length=16)

    # Optional secrets (with safe defaults)
    anthropic_api_key: str | None = None
    stripe_secret_key: str | None = None
    stripe_webhook_secret: str | None = None
    jina_api_key: str | None = None
    exa_api_key: str | None = None
    linear_api_key: str | None = None

    # Non-secret config
    ai_provider: str = "ollama"
    log_level: str = "info"
    node_env: str = "development"

    @field_validator("jwt_secret_key")
    @classmethod
    def jwt_secret_not_default(cls, v: str) -> str:
        if "change-in-production" in v and cls._is_production():
            raise ValueError("JWT secret must be changed in production")
        return v

    @staticmethod
    def _is_production() -> bool:
        import os
        return os.getenv("NODE_ENV") == "production"

    model_config = {"env_file": ".env", "env_file_encoding": "utf-8"}

import { z } from "zod";

const envSchema = z.object({
  // Required
  NEXT_PUBLIC_BACKEND_URL: z.string().url().default("http://localhost:8000"),
  NEXT_PUBLIC_FRONTEND_URL: z.string().url().default("http://localhost:3000"),

  // Optional secrets (server-side only)
  STRIPE_SECRET_KEY: z.string().startsWith("sk_").optional(),
  STRIPE_WEBHOOK_SECRET: z.string().startsWith("whsec_").optional(),
  CRON_SECRET: z.string().min(16).optional(),

  // Runtime config
  NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
});

export type Env = z.infer<typeof envSchema>;

function validateEnv(): Env {
  const result = envSchema.safeParse(process.env);
  if (!result.success) {
    console.error("Environment validation failed:");
    for (const issue of result.error.issues) {
      console.error(`  ${issue.path.join(".")}: ${issue.message}`);
    }
    if (process.env.NODE_ENV === "production") {
      throw new Error("Invalid environment configuration");
    }
  }
  return result.success ? result.data : (process.env as unknown as Env);
}

export const env = validateEnv();

import re

SECRET_PATTERNS = [
    re.compile(r"(sk[-_](?:test|live|ant)[-_])\w+", re.IGNORECASE),
    re.compile(r"(whsec_)\w+"),
    re.compile(r"(Bearer\s+)\S+"),
    re.compile(r"(password[\"':\s=]+)\S+", re.IGNORECASE),
    re.compile(r"(api[_-]?key[\"':\s=]+)\S+", re.IGNORECASE),
]


def redact_secrets(message: str) -> str:
    """Replace secret values with redacted placeholders."""
    for pattern in SECRET_PATTERNS:
        message = pattern.sub(r"\1[REDACTED]", message)
    return message

structlog.configure(
    processors=[
        # ... existing processors
        lambda _, __, event_dict: {
            k: redact_secrets(str(v)) if isinstance(v, str) else v
            for k, v in event_dict.items()
        },
        structlog.dev.ConsoleRenderer(),
    ]
)

def check_secrets_health() -> dict:
    """Validate secret presence and strength at startup."""
    settings = get_settings()
    issues: list[str] = []

    # Required secrets
    required = {
        "JWT_SECRET_KEY": settings.jwt_secret_key,
        "DATABASE_URL": settings.database_url,
        "BACKEND_API_KEY": settings.backend_api_key,
    }
    for name, value in required.items():
        if not value or len(value) < 16:
            issues.append(f"{name}: missing or too short (min 16 chars)")

    # Production-only checks
    if settings.node_env == "production":
        if "localhost" in settings.database_url:
            issues.append("DATABASE_URL: points to localhost in production")
        if settings.jwt_secret_key and len(settings.jwt_secret_key) < 64:
            issues.append("JWT_SECRET_KEY: should be ≥64 chars in production")

    return {
        "status": "healthy" if not issues else "unhealthy",
        "issues": issues,
        "secrets_configured": len(required) - len(issues),
        "secrets_total": len(required),
    }

# .github/workflows/ci.yml
env:
  # Map GitHub Secrets to environment variables
  DATABASE_URL: postgresql://test_user:test_pass@localhost:5432/test_db
  JWT_SECRET_KEY: ${{ secrets.JWT_SECRET_KEY || 'test-secret-for-ci-only-not-production' }}
  BACKEND_API_KEY: ${{ secrets.BACKEND_API_KEY || 'ci-test-key-minimum-16' }}

# docker-compose.yml
services:
  backend:
    env_file:
      - .env
    environment:
      # Override specific vars (higher precedence than .env)
      - DATABASE_URL=postgresql://starter_user:local_dev_password@postgres:5432/starter_db

### Secret Management Implementation

**Validation**: [Pydantic / Zod / both]
**Redaction**: [structlog processor / manual]
**Health Check**: [startup / deep endpoint / both]
**CI/CD**: [GitHub Actions secrets / env fallbacks]
**Docker**: [env_file / Docker secrets / both]
**Rotation**: [documented / automated]