config.py

import os
from dotenv import load_dotenv

# Load environment variables from .env file
load_dotenv()

# Workspace setup
WORKSPACE_DOMAIN = os.getenv("WORKSPACE_DOMAIN", "")

# OAuth 2.0 credentials (Desktop app client)
OAUTH_CLIENT_FILE = os.getenv("OAUTH_CLIENT_FILE", "client_secret.json")
TOKEN_FILE = os.getenv("TOKEN_FILE", "token.json")

# Gemini setup
GEMINI_API_KEY = os.getenv("GEMINI_API_KEY", "")

# AI models — ordered by preference (all free-tier eligible).
# The agent tries the primary model first and falls back to the next on rate limits.
MODELS = [
    "gemini-2.5-flash",         # Primary — best reasoning + speed balance
    "gemini-2.5-flash-lite",    # Lighter variant, higher rate limits
    "gemini-3-flash",           # Next-gen flash
    "gemini-3.1-flash-lite",    # Lightweight next-gen
    "gemma-3-27b-it",           # Largest Gemma, strong reasoning
    "gemma-3-12b-it",           # Mid-size Gemma
    "gemma-3-4b-it",            # Smaller Gemma
]

# Reports to fetch — all security-relevant Workspace audit log categories
APPLICATIONS_TO_MONITOR = [
    "login",              # Sign-ins, failed attempts, suspicious locations
    "admin",              # Admin console changes, privilege escalation
    "drive",              # File sharing, downloads, external sharing, deletions
    "token",              # OAuth token grants, third-party app authorizations
    "user_accounts",      # Email forwarding, delegates, password changes, POP/IMAP
    "gmail",              # Email send/receive, spam, phishing reports
    "calendar",           # Calendar sharing, event modifications
    "chat",               # Google Chat messages and spaces
    "meet",               # Meet calls, participants, recordings
    "mobile",             # Mobile device activity, wipes, policy changes
    "groups_enterprise",  # Group membership changes, settings
    "rules",              # DLP rule triggers and actions
    "saml",               # SAML SSO login events
]
MAX_RESULTS_PER_FETCH = 100

# Scopes needed for Reports API
SCOPES = ['https://www.googleapis.com/auth/admin.reports.audit.readonly']