"""OIDC configuration from environment (pydantic-settings)."""

from functools import lru_cache

from pydantic_settings import BaseSettings, SettingsConfigDict


class OIDCSettings(BaseSettings):
    model_config = SettingsConfigDict(env_prefix="IURBAN_OIDC_")

    issuer: str  # e.g. https://auth.iurban-lab.es/realms/iurban
    audience: str  # expected client_id in the `aud` claim
    jwks_ttl: int = 3600  # JWKS cache TTL in seconds
    # claim the tenant id is read from (may vary by realm mapping)
    tenant_claim: str = "tenant_id"
    # path to the roles within the token (Keycloak: realm_access.roles)
    roles_claim_path: str = "realm_access.roles"

    @property
    def jwks_uri(self) -> str:
        return f"{self.issuer.rstrip('/')}/protocol/openid-connect/certs"


@lru_cache
def get_settings() -> OIDCSettings:
    return OIDCSettings()  # type: ignore[call-arg]
