"""Runtime validation for security-sensitive application settings."""

from app.config import LEGACY_DEFAULT_SECRET, Settings


def validate_runtime_settings(settings: Settings) -> None:
    """Reject unsafe settings before scheduling monitoring work."""
    if settings.environment == "production":
        if not settings.secret_key.strip() or settings.secret_key == LEGACY_DEFAULT_SECRET:
            raise ValueError("SECRET_KEY must be provided by the runtime environment")
        if not settings.casdoor_endpoint.startswith("https://"):
            raise ValueError("CASDOOR endpoint must use TLS in production")

    if settings.wecom_notification_enabled:
        credentials = (
            settings.WECOM_CORP_ID,
            settings.WECOM_AGENT_ID,
            settings.WECOM_APP_SECRET,
        )
        if not all(credentials):
            raise ValueError("WECOM delivery requires corp ID, agent ID, and app secret")