import path from "node:path";

export const WORKSPACE_ROOT = "/home/underlistedx/public_html";
export const PROJECT_ROOT = path.join(WORKSPACE_ROOT, "ux7.underlisted-x.com");

const projectDenyList = new Set([
  "cgi-bin", "node_modules", "vendor", "storage", "logs", "log", "cache", "tmp",
  ...((process.env.PROJECT_DENY_LIST ?? "").split(",").map((value) => value.trim().toLowerCase()).filter(Boolean)),
]);

const integer = (value: string | undefined, fallback: number) => {
  const parsed = Number.parseInt(value ?? "", 10);
  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
};

export const config = Object.freeze({
  env: process.env.NODE_ENV === "production" ? "production" : "development",
  host: process.env.HOST ?? "127.0.0.1",
  port: integer(process.env.PORT, 3000),
  appUrl: process.env.APP_URL ?? "http://127.0.0.1:3000",
  sessionCookie: process.env.SESSION_COOKIE_NAME ?? "ux7_session",
  preauthCookie: "ux7_preauth",
  sessionTtlSeconds: integer(process.env.SESSION_TTL_SECONDS, 43_200),
  loginMaxAttempts: integer(process.env.LOGIN_MAX_ATTEMPTS, 5),
  loginWindowSeconds: integer(process.env.LOGIN_WINDOW_SECONDS, 900),
  lockoutSeconds: integer(process.env.LOGIN_LOCKOUT_SECONDS, 900),
  requestLimit: process.env.REQUEST_SIZE_LIMIT ?? "1mb",
  uploadMaxBytes: integer(process.env.UPLOAD_MAX_BYTES, 10 * 1024 * 1024),
  uploadRetentionHours: integer(process.env.UPLOAD_RETENTION_HOURS, 168),
  filePreviewMaxBytes: integer(process.env.FILE_PREVIEW_MAX_BYTES, 1_048_576),
  fileSearchMaxBytes: integer(process.env.FILE_SEARCH_MAX_BYTES, 262_144),
  fileSearchMaxEntries: integer(process.env.FILE_SEARCH_MAX_ENTRIES, 2_000),
  startupTimeoutMs: integer(process.env.STARTUP_TIMEOUT_MS, 15_000),
  agentProvider: process.env.AGENT_PROVIDER ?? "mock",
  secureCookies: (process.env.APP_URL ?? "").startsWith("https://") || process.env.NODE_ENV === "production",
  databasePath: process.env.DATABASE_PATH ?? path.join(PROJECT_ROOT, "storage/database/ux7.sqlite"),
  uploadRoot: path.join(PROJECT_ROOT, "storage/uploads"),
  fileSnapshotRoot: path.join(PROJECT_ROOT, "storage/backups/files"),
  publicRoot: path.join(PROJECT_ROOT, "public"),
  migrationsRoot: path.join(PROJECT_ROOT, "src/db/migrations"),
  projectDenyList,
});

if (process.env.WORKSPACE_ROOT && process.env.WORKSPACE_ROOT !== WORKSPACE_ROOT) {
  throw new Error("WORKSPACE_ROOT is a fixed security boundary and cannot be changed.");
}