"""
Dynamic API-credential loader.

get_credential("GOOGLE_TRANSLATE_API_KEY") returns, in order of preference:
  1. the active ApiCredential row in the MASTER database (cached ~60s), or
  2. the same-named Django setting / environment variable as fallback.

Keys edited in the master admin panel take effect within a minute with no
server restart. Call invalidate() after a write for an immediate refresh.
"""
import os
import time

from django.conf import settings

CACHE_TTL_SECONDS = 60

_cache = {}  # key -> (value, fetched_at)

KNOWN_CREDENTIALS = [
    {
        "key": "GEMINI_API_KEY",
        "label": "Gemini API Key",
        "description": "Google Gemini key used by the AI assistant, leave-reason "
                       "explanations and chat moderation.",
    },
    {
        "key": "GOOGLE_TRANSLATE_API_KEY",
        "label": "Google Translate API Key",
        "description": "Cloud Translation v2 key used by the mobile apps' "
                       "multi-language UI (served via the translate proxy).",
    },
    {
        "key": "ZEPTO_PASSWORD",
        "label": "ZeptoMail SMTP Password",
        "description": "SMTP credential for outgoing school emails (OTP, bulk email).",
    },
]


def _env_fallback(key, default=""):
    return getattr(settings, key, None) or os.getenv(key) or default


def get_credential(key, default=""):
    now = time.time()
    hit = _cache.get(key)
    if hit and now - hit[1] < CACHE_TTL_SECONDS:
        return hit[0] or _env_fallback(key, default)

    value = ""
    try:
        from .models import ApiCredential

        row = (
            ApiCredential.objects.using("default")
            .filter(key=key, is_active=True)
            .first()
        )
        value = (row.value or "").strip() if row else ""
    except Exception:
        # table missing / DB unavailable — fall back to env silently
        value = ""

    _cache[key] = (value, now)
    return value or _env_fallback(key, default)


def invalidate(key=None):
    if key is None:
        _cache.clear()
    else:
        _cache.pop(key, None)


def ensure_known_rows():
    """Create rows for the known credentials (seeded from env) if missing."""
    from .models import ApiCredential

    for item in KNOWN_CREDENTIALS:
        ApiCredential.objects.using("default").get_or_create(
            key=item["key"],
            defaults={
                "label": item["label"],
                "description": item["description"],
                "value": _env_fallback(item["key"], ""),
            },
        )