"""Production settings. Refuses to start with an unsafe configuration."""
from django.core.exceptions import ImproperlyConfigured

from .base import *  # noqa: F401,F403
from .base import ALLOWED_HOSTS, SECRET_KEY, env_bool, env_list

DEBUG = False

if not SECRET_KEY or SECRET_KEY.startswith("dev-only") or len(SECRET_KEY) < 40:
    raise ImproperlyConfigured("DJANGO_SECRET_KEY must be set to a random value of at least 40 characters.")
if not ALLOWED_HOSTS or "*" in ALLOWED_HOSTS:
    raise ImproperlyConfigured("DJANGO_ALLOWED_HOSTS must list explicit host names (no '*').")

CSRF_TRUSTED_ORIGINS = env_list("DJANGO_CSRF_TRUSTED_ORIGINS")  # e.g. https://erp.example.com
SECURE_SSL_REDIRECT = env_bool("DJANGO_SSL_REDIRECT", True)
# Passenger/Apache terminates TLS; set DJANGO_BEHIND_PROXY=False if the app is served over HTTPS directly.
if env_bool("DJANGO_BEHIND_PROXY", True):
    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_HSTS_SECONDS = int(__import__("os").environ.get("DJANGO_HSTS_SECONDS", "3600"))  # raise after HTTPS is verified
# Deliberately off: on a shared cPanel account other subdomains may not be HTTPS-only, and preload is irreversible.
# The two matching deploy-check warnings are silenced on purpose; see docs/security_checklist.md.
SECURE_HSTS_INCLUDE_SUBDOMAINS = False
SECURE_HSTS_PRELOAD = False
SILENCED_SYSTEM_CHECKS = ["security.W005", "security.W021"]