"""Cross-cutting defaults for a2a-passport.

Deliberately does NOT hold IdP URLs, secrets, or audiences as global state --
those are constructor arguments to OAuth2ClientCredentialsProvider and the
TokenVerifier implementations (see auth/oauth2.py, auth/verifiers.py) because
a single agent process may legitimately hold credentials for, and verify
tokens from, more than one identity provider at once (that's the whole point
of federation: talking to a Keycloak-issued agent and an Auth0-issued agent
from the same process). Only true cross-cutting knobs -- timeouts, retry
counts -- live here.
"""
from __future__ import annotations

from pydantic_settings import BaseSettings, SettingsConfigDict


class PassportSettings(BaseSettings):
    model_config = SettingsConfigDict(env_prefix="A2A_PASSPORT_")

    request_timeout_seconds: float = 10.0
    retry_attempts: int = 3
    retry_max_wait_seconds: float = 2.0
    token_cache_leeway_seconds: int = 10  # refresh this many seconds before actual expiry


settings = PassportSettings()
