def _validate_startup_config() -> None:
    errors: list[str] = []
    if not config.SECRET_KEY_API or len(config.SECRET_KEY_API) < 32:
        errors.append("SECRET_KEY_API doit contenir au moins 32 caractères.")
    if not config.GPT_API_KEY:
        errors.append("GPT_API_KEY est requise.")
    if errors:
        for err in errors:
            logger.critical("Configuration invalide : %s", err)
        sys.exit(1)

# Swagger désactivé en production
app = FastAPI(
    docs_url="/docs" if config.DEBUG_MODE else None,
    redoc_url="/redoc" if config.DEBUG_MODE else None,
    on_startup=[verify_redis_connection],
)

class UserStore(ABC):
    @abstractmethod
    async def authenticate_user(self, username: str, password: str) -> dict | None: ...
    @abstractmethod
    async def create_user_with_config(self, *, username: str, ...) -> dict: ...
    @abstractmethod
    async def store_refresh_token(self, *, username: str, ...) -> None: ...

# Façade publique — injection via set_user_store() dans les tests
_USER_STORE: UserStore = FirestoreUserStore.from_env()

def set_user_store(store: UserStore) -> None:
    global _USER_STORE
    _USER_STORE = store

user_config = await get_user_config_from_store(username)
if user_config is None:
    raise HTTPException(403, "Utilisateur non enregistre")

index_name = user_config.get("index_name")
if not index_name:
    raise HTTPException(400, "Aucune base vectorielle configuree")

if current_user.get("role") == "rh" and not await user_owns_vector_base(
        int(current_user["id"]), str(index_name)):
    raise HTTPException(404, "La collection n'existe pas dans Qdrant.")

if not await collection_exists(index_name):
    raise HTTPException(404, "La collection n'existe pas dans Qdrant.")

rag_chain = (
    {"context": lambda x: x["context"], "question": lambda x: x["question"],
     "history": lambda x: x["history"]}
    | prompt | llm | StrOutputParser()
)
async for chunk in rag_chain.astream(chain_input):
    yield chunk  # → StreamingResponse text/plain

await create_new_vector_store(collection_name, model_name)
try:
    await register_vector_base(base_name=collection_name, ...)
except Exception:
    logger.exception("Firestore KO — rollback Qdrant")
    try:
        await delete_vector_store(collection_name)
    except Exception:
        logger.exception("Rollback Qdrant échoué — orphelin possible")
    raise

def _create_token(*, username, user_id, token_type, expires_delta):
    now = datetime.now(timezone.utc)
    payload = {
        "username": username, "user_id": int(user_id),
        "type": token_type,
        "jti": secrets.token_hex(16),  # non-rejouable
        "iat": int(now.timestamp()),
        "exp": int((now + expires_delta).timestamp()),
    }
    return jwt.encode(payload, _get_secret_key(), algorithm="HS256")

def hash_token(token: str) -> str:
    # SHA-256 du refresh token — jamais le brut en base
    return hashlib.sha256(token.encode("utf-8")).hexdigest()

pwd_context = CryptContext(schemes=["bcrypt_sha256", "bcrypt"], deprecated="auto")