/** Minimal env-var settings — mirrors the style of `apps/ai-service/config.py`
 * (plain, explicit fields, no framework-specific config module) rather than
 * pulling in `@nestjs/config` for four variables. */
export interface Settings {
  port: number;
  postgresDsn: string;
  jwtSecret: string;
  jwtExpiresIn: string;
}

export function loadSettings(): Settings {
  const jwtSecret = process.env.JWT_SECRET ?? "";
  if (!jwtSecret) {
    // Fail closed at startup, not at the first login attempt — the same
    // posture as ai-service's manifest check in bootstrap.py: a service that
    // would sign tokens with an empty/guessable secret must not start at all.
    throw new Error(
      "JWT_SECRET is required and must not be empty. Refusing to start with " +
        "no secret rather than silently signing tokens no one can trust."
    );
  }
  return {
    port: Number(process.env.PORT ?? 3010),
    postgresDsn:
      process.env.POSTGRES_DSN ??
      "postgresql://duoc_thu:duoc_thu@localhost:5432/duoc_thu",
    jwtSecret,
    jwtExpiresIn: process.env.JWT_EXPIRES_IN ?? "12h",
  };
}