import logging

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

from app.api.accounts import router as account_router
from app.api.artists import router as artist_router
from app.api.assignments import router as assignment_router
from app.api.auth import router as auth_router
from app.api.availability import router as availability_router
from app.api.badges import router as badge_router
from app.api.day_parts import router as day_part_router
from app.api.editions import router as edition_router
from app.api.forms import router as form_router
from app.api.health import router as health_router
from app.api.imports import router as import_router
from app.api.matrix import router as matrix_router
from app.api.notifications import router as notification_router
from app.api.position_sheets import router as position_sheets_router
from app.api.positions import router as position_router
from app.api.shifts import router as shift_router
from app.api.solver import router as solver_router
from app.api.volunteers import router as volunteer_router
from app.config import get_settings
from app.logging_config import configure_logging

configure_logging()

settings = get_settings()

if settings.is_production and not settings.email_enabled:
    # Avec EMAIL_ENABLED=false, le jeton de lien magique est journalisé en
    # clair (confort de dev, voir `api/auth.py`) — acceptable en local, jamais
    # en production : quiconque lit les logs du conteneur peut alors se
    # connecter à la place de n'importe quel bénévole ou référent.
    logging.getLogger("app.main").warning(
        "EMAIL_ENABLED=false en production : les liens magiques sont "
        "journalisés en clair au lieu d'être envoyés par email. Configurer "
        "le SMTP avant l'ouverture au public."
    )

if settings.is_production and not settings.hcaptcha_secret_key:
    # Le formulaire public (`app/api/forms.py`) reste accessible sans
    # HCAPTCHA_SECRET_KEY, mais sans aucune protection anti-robot au-delà du
    # filet de sécurité global par édition (`form_submission_limiter`).
    logging.getLogger("app.main").warning(
        "HCAPTCHA_SECRET_KEY absente en production : le formulaire public "
        "d'inscription n'est pas protégé par captcha."
    )

app = FastAPI(title="Gestion des bénévoles", version="0.1.0")

app.add_middleware(
    CORSMiddleware,
    allow_origins=settings.cors_origins,
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

app.include_router(health_router)
app.include_router(auth_router)
app.include_router(edition_router)
app.include_router(day_part_router)
app.include_router(account_router)
app.include_router(import_router)
app.include_router(artist_router)
app.include_router(volunteer_router)
app.include_router(availability_router)
app.include_router(position_router)
app.include_router(shift_router)
app.include_router(assignment_router)
app.include_router(solver_router)
app.include_router(matrix_router)
app.include_router(notification_router)
app.include_router(badge_router)
app.include_router(form_router)
app.include_router(position_sheets_router)