from pathlib import Path

from django.conf import settings


def security_readiness_checks():
    checks = []

    def add(name, ok, detail):
        checks.append({"name": name, "ok": bool(ok), "detail": detail})

    add("DEBUG disabled", not settings.DEBUG, "DEBUG must be False outside development.")
    add("Strong secret key configured", bool(settings.SECRET_KEY and "unsafe-development" not in settings.SECRET_KEY), "DJANGO_SECRET_KEY must come from the environment.")
    add("Allowed hosts configured", bool(settings.ALLOWED_HOSTS), "DJANGO_ALLOWED_HOSTS must contain the Local UAT/production host names.")
    add("Secure session cookie", settings.DEBUG or getattr(settings, "SESSION_COOKIE_SECURE", False), "Required when serving over HTTPS.")
    add("Secure CSRF cookie", settings.DEBUG or getattr(settings, "CSRF_COOKIE_SECURE", False), "Required when serving over HTTPS.")
    add("SSL redirect", settings.DEBUG or getattr(settings, "SECURE_SSL_REDIRECT", False), "Enable on the deployed HTTPS site.")
    add("HSTS enabled", settings.DEBUG or getattr(settings, "SECURE_HSTS_SECONDS", 0) > 0, "Start low during staging, increase after HTTPS is verified.")
    add("Clickjacking protection", getattr(settings, "X_FRAME_OPTIONS", "") == "DENY", "X-Frame-Options is DENY.")
    add("Login lockout configured", getattr(settings, "LOGIN_MAX_FAILED_ATTEMPTS", 0) >= 3, "Database-backed failed-login throttling is enabled.")

    backup_dir = Path(settings.BACKUP_DIR)
    add("Backup directory configured", bool(str(backup_dir)), f"Configured path: {backup_dir}")
    add("PostgreSQL selected", settings.DATABASES["default"]["ENGINE"].endswith("postgresql"), "Backup/restore commands target PostgreSQL custom-format dumps.")
    return checks