from pathlib import Path
import os
from dotenv import load_dotenv
from urllib.parse import urlparse, parse_qsl

load_dotenv(Path(__file__).resolve().parent.parent / ".env")

BASE_DIR = Path(__file__).resolve().parent.parent

SECRET_KEY = "django-insecure-blueprint-dev-key-change-in-production"

# 🤖 SUIS DEBUG PINTAR KALIS BOCOR: Render sentiasa False. Local baca dari .env.
IS_RENDER = os.environ.get("RENDER", "").lower() == "true"
DEBUG = False if IS_RENDER else (os.environ.get("DEBUG", "False").lower() == "true")

ALLOWED_HOSTS = ["localhost", "127.0.0.1", "ipes-a7qj.onrender.com", "*.onrender.com", "*.trycloudflare.com"]

INSTALLED_APPS = [
    "django.contrib.admin",
    "django.contrib.contenttypes",
    "django.contrib.auth",
    "django.contrib.messages",
    "django.contrib.sessions",
    "django.contrib.staticfiles",
    "rest_framework",
    "corsheaders",
    "anymail",
    "problems",
    "bengkel",
    "superadmin_portal",
    "ai_engine",
]

AUTHENTICATION_BACKENDS = [
    "problems.backends.EmailOrUsernameBackend",
]

MIDDLEWARE = [
    "corsheaders.middleware.CorsMiddleware",
    "django.middleware.security.SecurityMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.locale.LocaleMiddleware", 
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
    # --- AKU TAMBAH ANTI-CACHE UTK KESELAMATAN  ---
    "bengkel.middleware.NoCacheMiddleware",
]

# --- AKU TAMBAH CODE NI UTK SYSTEM TAHU TAK SIMPAN CACHE LPS LOGOUT  ---
CACHE_MIDDLEWARE_SECONDS = 0 
CACHE_MIDDLEWARE_KEY_PREFIX = ''

ROOT_URLCONF = "config.urls"

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "DIRS": [BASE_DIR / "templates"],
        "APP_DIRS": True,
        "OPTIONS": {
            "context_processors": [
                "django.template.context_processors.request",
                "django.contrib.auth.context_processors.auth",
                "django.contrib.messages.context_processors.messages",
                "django.template.context_processors.i18n",  
            ],
        },
    }
]

WSGI_APPLICATION = "config.wsgi.application"

# Membaca URL dari fail .env dan menterjemahkannya untuk Django
tmpPostgres = urlparse(os.getenv("DATABASE_URL"))

# Pastikan path ditukar ke string sekiranya ia dibaca sebagai bytes oleh sistem
db_name_str = tmpPostgres.path.decode('utf-8') if isinstance(tmpPostgres.path, bytes) else tmpPostgres.path

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': db_name_str.replace('/', ''),
        'USER': tmpPostgres.username,
        'PASSWORD': tmpPostgres.password,
        'HOST': tmpPostgres.hostname,
        'PORT': 5432,
        'OPTIONS': dict(parse_qsl(tmpPostgres.query)),
    }
}

# Allow all origins during development
CORS_ALLOW_ALL_ORIGINS = True

REST_FRAMEWORK = {
    "DEFAULT_RENDERER_CLASSES": ["rest_framework.renderers.JSONRenderer"],
    "DEFAULT_PARSER_CLASSES": ["rest_framework.parsers.JSONParser"],
}

STATIC_URL = "/static/"
STATICFILES_DIRS = [BASE_DIR / "static"]
STATIC_ROOT = BASE_DIR / "staticfiles"  # <--- TAMBAH BARIS INI UNTUK PELAYAN RENDER
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"

# ── Keselamatan & Auto Logout Sesi (Idle Timeout) ─────────────────────────────
# 10,800 saat = 3 Jam masa tidak aktif
SESSION_COOKIE_AGE = 10800  

# Wajib True: Reset semula masa 3 jam ke angka sifar setiap kali pengguna klik/aktif
SESSION_SAVE_EVERY_REQUEST = True  

# Wajib True: Terus padam sesi dan log keluar jika peserta pangkah (tutup) browser
SESSION_EXPIRE_AT_BROWSER_CLOSE = True  

# ── Pengurusan Bahasa (Internationalization / i18n) ───────────────────────────
from django.utils.translation import gettext_lazy as _

LANGUAGE_CODE = 'ms' # Bahasa lalai ialah Bahasa Melayu
TIME_ZONE = 'Asia/Kuala_Lumpur'
USE_I18N = True # Wajib True
USE_L10N = True # Wajib True
USE_TZ = True

# Senarai bahasa yang disokong oleh sistem
from django.utils.translation import gettext_lazy as _
LANGUAGES = (
    ('ms', _('Bahasa Melayu')),
    ('en-gb', _('English (UK)')),
)

# Lokasi di mana fail kamus terjemahan (.po) akan disimpan
LOCALE_PATHS = [
    os.path.join(BASE_DIR, 'locale'),
]

# ── Media files (uploads) ─────────────────────────────────────────────────────
MEDIA_URL  = "/media/"
MEDIA_ROOT = BASE_DIR / "media"

# ── OpenAI API ────────────────────────────────────────────────────────────────
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "")
LLM_MODEL = os.environ.get("LLM_MODEL", "gpt-4o-mini")

# Auth
LOGIN_URL          = "/login/"
LOGIN_REDIRECT_URL = "/bengkel/dashboard/"
LOGOUT_REDIRECT_URL = "/"

# ── Email (Web API melalui Anymail & Brevo) ──────────────────────────────────
EMAIL_BACKEND = "anymail.backends.sendinblue.EmailBackend"
DEFAULT_FROM_EMAIL = "Sistem IPES KKM <systempilottest@gmail.com>"

 

brevo_key = os.environ.get("BREVO_API_KEY")

if not brevo_key:
    print("⚠️ AMARAN: BREVO_API_KEY TIDAK DIJUMPAI DI ENVIRONMENT VARIABLES!")

ANYMAIL = {
    "SENDINBLUE_API_KEY": brevo_key,
}

# ── AWS SQS Direct Message Integration (Serverless Migration) ──
import os

AWS_ACCESS_KEY_ID = os.getenv("AWS_ACCESS_KEY_ID", "")
AWS_SECRET_ACCESS_KEY = os.getenv("AWS_SECRET_ACCESS_KEY", "")
AWS_REGION_NAME = "us-east-1"  # 100% Tepat ikut screenshot abang!
AWS_SQS_QUEUE_URL = "https://sqs.us-east-1.amazonaws.com/563999587551/celery"  # Guna url sedia ada abang!

# 🤖 ENJIN PEMILIH BROKER CELERY PINTAR HIBRID (MEMURAI VS AWS SQS)
FORCE_LOCAL = os.environ.get("FORCE_LOCAL_REDIS", "False").lower() == "true"

if FORCE_LOCAL:
    # 🔴 JIKA SUIS TRUE: Celery akan guna Memurai (Local Redis)
    CELERY_BROKER_URL = os.environ.get("REDIS_URL", "redis://127.0.0.1:6379/0")
    CELERY_RESULT_BACKEND = CELERY_BROKER_URL
    print("🔌 CELERY STATUS: Menggunakan MEMURAI (LOCAL REDIS) sebagai Broker.")
else:
    # 🌐 JIKA SUIS FALSE: Celery akan guna AWS SQS (Untuk Live Render)
    CELERY_BROKER_URL = 'sqs://'
    CELERY_BROKER_TRANSPORT_OPTIONS = {
        'aws_access_key_id': AWS_ACCESS_KEY_ID,
        'aws_secret_access_key': AWS_SECRET_ACCESS_KEY,
        'region': AWS_REGION_NAME,
        'predefined_queues': {
            'celery': {
                'url': AWS_SQS_QUEUE_URL
            }
        }
    }
    print("🦅 CELERY STATUS: Menggunakan AWS SQS sebagai Broker.")

CELERY_BROKER_CONNECTION_RETRY_ON_STARTUP = True

# 🔒 KESELAMATAN DEPLOYMENT (Kalis Ralat 403 CSRF di Live Server Render)
CSRF_TRUSTED_ORIGINS = [
    "https://ipes-a7qj.onrender.com",
    "https://*.onrender.com",
    "http://localhost",
    "http://127.0.0.1",
    "https://*.trycloudflare.com" # Kekalkan fallback cloudflare lama abang
]

# 🍪 Pengaktifan Perlindungan Kiskut (Cookies) Khas Persekitaran HTTPS Live Server
if not DEBUG:
    CSRF_COOKIE_SECURE = True
    SESSION_COOKIE_SECURE = True
    CSRF_COOKIE_HTTPONLY = True
    SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')