export const env = {
  port: Number(process.env.PORT ?? 3000),
  nodeEnv: process.env.NODE_ENV ?? "development",
  appBaseUrl: process.env.APP_BASE_URL ?? "http://localhost:3000",
  sessionSecret: process.env.SESSION_SECRET ?? "dev-insecure-session-secret-change-me",
  sessionDir: process.env.SESSION_DIR ?? "../data/sessions",
  databasePath: process.env.DATABASE_PATH ?? "../data/homelab-manager.sqlite",
  credentialsEncryptionKey: process.env.CREDENTIALS_ENCRYPTION_KEY ?? "",
  authentik: {
    issuerUrl: process.env.AUTHENTIK_ISSUER_URL ?? "",
    clientId: process.env.AUTHENTIK_CLIENT_ID ?? "",
    clientSecret: process.env.AUTHENTIK_CLIENT_SECRET ?? "",
  },
  get authEnabled() {
    return Boolean(this.authentik.issuerUrl && this.authentik.clientId && this.authentik.clientSecret);
  },
  get credentialsEncryptionEnabled() {
    return this.credentialsEncryptionKey.length === 64;
  },
};

export function warnIfAuthNotConfigured() {
  if (!env.authEnabled) {
    console.warn(
      "AUTHENTIK_ISSUER_URL / AUTHENTIK_CLIENT_ID / AUTHENTIK_CLIENT_SECRET are not fully set. " +
        "The app will boot, but /auth/login and /auth/logout will fail until they are configured.",
    );
  }
  if (!env.credentialsEncryptionEnabled) {
    console.warn(
      "CREDENTIALS_ENCRYPTION_KEY is not set to a 64-character hex string. " +
        "Saving integration credentials (Proxmox/Synology/etc API tokens) will fail until it is configured.",
    );
  }
}