/// Application configuration from compile-time environment variables.
///
/// ## Defaults (public URLs - auth required)
/// Default values use the public https://*.schweitz.net domains so browser
/// clients work from any machine (NPM fronts them; LAN clients bypass
/// Authentik via source-IP rules):
/// ```bash
/// flutter run -d chrome
/// ```
///
/// ## Development (LAN - no auth required)
/// Override with LAN URLs to hit services directly without OIDC:
/// ```bash
/// flutter run -d chrome \
///   --dart-define=CORE_API_URL=http://192.168.86.149:8083 \
///   --dart-define=TATLOCK_API_URL=http://192.168.86.149:8000
/// ```
class AppConfig {
  AppConfig._();

  /// Core API base URL
  /// - Default: https://api.schweitz.net (requires OIDC)
  /// - LAN override: http://192.168.86.149:8083 (no auth)
  static const coreApiUrl = String.fromEnvironment(
    'CORE_API_URL',
    defaultValue: 'https://api.schweitz.net',
  );

  /// Tatlock API base URL
  /// - Default: https://tatlock.schweitz.net (requires OIDC)
  /// - LAN override: http://192.168.86.149:8000 (no auth)
  static const tatlockApiUrl = String.fromEnvironment(
    'TATLOCK_API_URL',
    defaultValue: 'https://tatlock.schweitz.net',
  );

  /// Authentik OIDC discovery URL
  static const authDiscoveryUrl = String.fromEnvironment(
    'AUTH_DISCOVERY_URL',
    defaultValue:
        'https://auth.schweitz.net/application/o/tatlock-ui/.well-known/openid-configuration',
  );

  /// Authentik client ID
  static const authClientId = String.fromEnvironment(
    'AUTH_CLIENT_ID',
    defaultValue: 'tatlock-ui',
  );

  /// Authentik redirect URI scheme (for mobile/native)
  static const authRedirectScheme = String.fromEnvironment(
    'AUTH_REDIRECT_SCHEME',
    defaultValue: 'net.schweitz.tatlock',
  );

  /// Web app base URL (for OIDC redirect URI on web)
  static const webBaseUrl = String.fromEnvironment(
    'WEB_BASE_URL',
    defaultValue: 'https://home.schweitz.net',
  );

  /// Whether running in debug mode
  static const isDebug = bool.fromEnvironment('DEBUG', defaultValue: false);

  /// Whether auth is required (false for LAN development)
  static bool get requiresAuth =>
      coreApiUrl.contains('schweitz.net') ||
      tatlockApiUrl.contains('schweitz.net');

}