import logging

from django.apps import AppConfig


class AndreaSvcWebConfig(AppConfig):
    """The base as a Django app — ready() registers the drf-spectacular auth-scheme extension
    (schema.py) and emits the one-line credential posture announcement. No models."""

    name = "andrea_svc_web"
    verbose_name = "Andrea web-service base"

    def ready(self):
        from . import schema        # noqa: F401 — importing registers the OpenApiAuthenticationExtension

        # §6.1 — ONE machine-parsable credential line at every start, unconditionally; WARNING when
        # the posture is not `enforcing`. The repeated lesson is that credential state was SILENT:
        # infra#263 lost 8 days of ingestion, rm#209's tasks-MCP 401 landed 3 days after the
        # rotation that caused it, and the first cred-drift run found mcp-builds already 401-ing
        # that nobody knew about. An unconfigured service is never silent again.
        #
        # ⚑ Emitted HERE and not from SECRETS.load(), because load() runs while settings.py is
        # still executing — Django has not configured logging at that point, so an INFO record
        # would be dropped on the floor.
        try:
            from django.conf import settings

            from .creds import current
            secrets = current()
            if secrets is not None:
                # A service that overrides SERVICE_NAME AFTER the star-import would otherwise be
                # announced and stamped as "andrea-service" — the same mis-tag LOGGING_CONFIG
                # already exists to fix, in the one place where a wrong name is a wrong stamp.
                secrets.rebind_service(getattr(settings, "SERVICE_NAME", ""))
                secrets.announce()
        except Exception:                                    # noqa: BLE001 — never break app startup
            logging.getLogger("andrea_svc_web").debug("creds: announcement skipped", exc_info=True)
