"""
Production settings.

Everything that can be hardened is hardened here; the module intentionally
fails loudly on start-up when a required secret is missing rather than falling
back to an insecure default.
"""

from .base import *  # noqa: F403
from .base import DEBUG, SECRET_KEY, env

# ---------------------------------------------------------------------------
# Fail fast on unsafe configuration
# ---------------------------------------------------------------------------
if DEBUG:  # pragma: no cover - configuration guard
    raise RuntimeError("DJANGO_DEBUG must be false when using production settings.")

if len(SECRET_KEY) < 50:  # pragma: no cover - configuration guard
    raise RuntimeError("DJANGO_SECRET_KEY must be at least 50 characters in production.")

# ---------------------------------------------------------------------------
# Transport security
# ---------------------------------------------------------------------------
SECURE_SSL_REDIRECT = env.bool("SECURE_SSL_REDIRECT", default=True)
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
SECURE_HSTS_SECONDS = 31_536_000  # one year
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SAMESITE = "Strict"
CSRF_COOKIE_SAMESITE = "Strict"

# ---------------------------------------------------------------------------
# Misc hardening
# ---------------------------------------------------------------------------
# Admin lives behind an unguessable prefix so credential stuffing bots miss it.
ADMIN_URL = env("DJANGO_ADMIN_URL", default="admin/")

# Deny by default; CORS_ALLOWED_ORIGINS must be set explicitly.
CORS_ALLOW_ALL_ORIGINS = False