"""Config file for lambda function."""

import os

# AWS region configuration
DEFAULT_AWS_REGION = 'us-east-1'
AWS_REGION = os.environ.get('AWS_REGION', DEFAULT_AWS_REGION)

# Environment setup
QA_ENVIRONMENT = 'qa'
PROD_ENVIRONMENT = 'prod'
ENVIRONMENT = os.environ.get('ENVIRONMENT', QA_ENVIRONMENT)

SENTRY_DSN = os.environ.get('SENTRY_DSN')

# MySQL access settings (for user creation)
# Set to read (default) or readwrite; dev is readwrite by default
MYSQL_ACCESS_TYPE = os.environ.get('MYSQL_ACCESS_TYPE', 'read')
PASSWORD_MIN_LENGTH = 24
USER_CREDENTIALS_SECRET_PREFIX = 'users'

# PostgreSQL role passwords (see src/logic/secrets.py). The sanitise lambda
# reads known dev/QA role passwords from a per-target-database Secrets Manager
# secret named {prefix}{target_db_name}/{suffix}, e.g.
# qa/sanitise-rds-data/qa-songwhip/postgres-user-passwords. The per-database
# name lets one deployment that sanitises several databases in the same account
# keep a separate secret for each.
#
# The prefix is optional: when ROLE_PASSWORDS_SECRET_NAME_PREFIX is unset (e.g.
# MySQL-only accounts) no secret is read and roles are left passwordless. Set
# it to the lambda's own {env}/{service_name}/ namespace so the
# terraform-lambda/terraform-fargate module's auto-attached policy grants
# access without an extra IAM statement.
ROLE_PASSWORDS_SECRET_NAME_PREFIX = os.environ.get(
    'ROLE_PASSWORDS_SECRET_NAME_PREFIX')
ROLE_PASSWORDS_SECRET_SUFFIX = 'postgres-user-passwords'

# Timeouts
PENDING_CHANGES_WAIT_TIMEOUT = int(
    os.environ.get('PENDING_CHANGES_WAIT_TIMEOUT', 300))

# Retry settings for master password reset
PASSWORD_RESET_RETRY_LIMIT = int(
    os.environ.get('PASSWORD_RESET_RETRY_LIMIT', 6))
PASSWORD_RESET_RETRY_DELAY = int(
    os.environ.get('PASSWORD_RESET_RETRY_DELAY', 10))