#FastAPI Pydantic Settings多环境配置完全指南

# ❌ 错误示范：硬编码配置
DATABASE_URL = "sqlite:///dev.db"   # 上线时忘记修改，生产环境用了 SQLite
SECRET_KEY = "dev-secret-123"      # 密钥暴露在代码中，安全风险极高
DEBUG = True                       # 生产环境开启调试模式，敏感信息可能泄露

# ✅ 正确做法：环境驱动的配置
# 不同环境使用不同的 .env 文件，代码完全统一
# .env.development  → 本地开发
# .env.testing      → 自动化测试
# .env.production   → 生产环境

# config/base.py
from pydantic_settings import BaseSettings, SettingsConfigDict
from pydantic import Field, field_validator
from typing import List

class BaseConfig(BaseSettings):
    # 配置文件加载规则
    model_config = SettingsConfigDict(
        env_file=".env",                 # 默认读取 .env 文件
        env_file_encoding="utf-8",
        extra="forbid"                   # 不允许出现未定义的配置项
    )

    # 应用基本信息
    app_name: str = Field(default="FastAPI App", min_length=1)
    app_version: str = "1.0.0"
    environment: str = Field(
        default="development",
        pattern=r"^(development|testing|production)$"
    )

    # 调试与服务器设置
    debug: bool = False
    host: str = "127.0.0.1"
    port: int = Field(default=8000, ge=1, le=65535)

    # 跨域资源共享(CORS)白名单
    cors_allow_origins: List[str] = Field(default_factory=list)

    # 便利的属性，用于判断当前环境
    @property
    def is_production(self) -> bool:
        return self.environment == "production"

    @property
    def is_development(self) -> bool:
        return self.environment == "development"

    # 解析逗号分隔的 CORS 来源字符串（环境变量常以字符串形式传入）
    @field_validator("cors_allow_origins", mode="before")
    @classmethod
    def parse_cors_origins(cls, v):
        if isinstance(v, str):
            return [origin.strip() for origin in v.split(",") if origin.strip()]
        return v

# config/environments.py
from .base import BaseConfig
from pydantic import Field

class DevelopmentConfig(BaseConfig):
    debug: bool = True
    database_url: str = "sqlite+aiosqlite:///dev.db"
    cors_allow_origins: List[str] = ["http://localhost:3000"]

class ProductionConfig(BaseConfig):
    debug: bool = False
    database_url: str = Field(description="生产数据库URL", min_length=10)
    cors_allow_origins: List[str] = ["https://yourapp.com"]

    # 强制检查：生产环境绝不能使用 SQLite
    @field_validator("database_url")
    @classmethod
    def validate_prod_db(cls, v):
        if "sqlite" in v.lower():
            raise ValueError("生产环境不能使用SQLite")
        return v

# config/__init__.py
import os
from functools import lru_cache
from .environments import DevelopmentConfig, ProductionConfig, BaseConfig

def get_config() -> BaseConfig:
    """根据 ENVIRONMENT 环境变量动态选择配置类"""
    env = os.getenv("ENVIRONMENT", "development").lower()
    config_map = {
        "development": DevelopmentConfig,
        "production": ProductionConfig
    }
    return config_map.get(env, DevelopmentConfig)()

@lru_cache()
def get_cached_config() -> BaseConfig:
    """带缓存的配置获取函数，避免重复创建实例"""
    return get_config()

from fastapi import FastAPI, Depends
from config import get_cached_config, BaseConfig

app = FastAPI()

@app.get("/info")
def info(config: BaseConfig = Depends(get_cached_config)):
    return {
        "app_name": config.app_name,
        "environment": config.environment,
        "debug": config.debug
    }

# config/validated.py
from .base import BaseConfig
from enum import Enum
from typing import Literal

class LogLevel(str, Enum):
    DEBUG = "DEBUG"
    INFO = "INFO"
    WARNING = "WARNING"
    ERROR = "ERROR"

class ValidatedConfig(BaseConfig):
    log_level: LogLevel = LogLevel.INFO
    cache_strategy: Literal["memory", "redis"] = "memory"

    @field_validator("cache_strategy")
    @classmethod
    def check_redis_url(cls, v, info):
        if v == "redis":
            # 如果选择 redis，必须提供 REDIS_URL
            redis_url = info.data.get("redis_url")
            if not redis_url:
                raise ValueError("使用 redis 缓存模式时必须设置 redis_url")
        return v

# config/security.py
import os
from typing import Optional

def get_secret(key: str, default: Optional[str] = None) -> Optional[str]:
    """
    优先从 /run/secrets/<key> 读取（Docker Secrets 标准路径），
    如果不存在则回退到环境变量。
    """
    secret_path = f"/run/secrets/{key}"
    if os.path.exists(secret_path):
        with open(secret_path, "r") as f:
            return f.read().strip()
    return os.getenv(key, default)

from config.security import get_secret

class ProductionConfig(BaseConfig):
    secret_key: str = Field(default_factory=lambda: get_secret("APP_SECRET_KEY", "change_me"))