# ❌ MAUVAISE PRATIQUE - Credentials en dur
import requests

API_KEY = "sk-1234567890abcdef"  # Exposé dans le code !
DATABASE_URL = "postgresql://user:password@localhost/db"

def call_api():
    response = requests.get(
        "https://api.example.com/data",
        headers={"Authorization": f"Bearer {API_KEY}"}
    )
    return response.json()

# ✅ BONNE PRATIQUE - Variables d'environnement
import os
import requests
from typing import Optional

def get_env_var(key: str, default: Optional[str] = None, required: bool = True) -> str:
    """Récupère une variable d'environnement de manière sécurisée"""
    value = os.getenv(key, default)
    
    if required and value is None:
        raise ValueError(f"Variable d'environnement '{key}' requise mais non définie")
    
    return value

# Configuration sécurisée
API_KEY = get_env_var("API_KEY")
DATABASE_URL = get_env_var("DATABASE_URL")

def call_api():
    response = requests.get(
        "https://api.example.com/data",
        headers={"Authorization": f"Bearer {API_KEY}"}
    )
    return response.json()

2. Configuration Multi-Environnements

# config/settings.py
import os
from enum import Enum
from dataclasses import dataclass
from typing import Optional

class Environment(Enum):
    DEVELOPMENT = "development"
    STAGING = "staging"
    PRODUCTION = "production"

@dataclass
class DatabaseConfig:
    host: str
    port: int
    name: str
    user: str
    password: str
    ssl_mode: str = "prefer"
    
    @property
    def url(self) -> str:
        return f"postgresql://{self.user}:{self.password}@{self.host}:{self.port}/{self.name}?sslmode={self.ssl_mode}"

@dataclass
class AppConfig:
    environment: Environment
    debug: bool
    log_level: str
    database: DatabaseConfig
    redis_url: str
    secret_key: str
    
    @classmethod
    def from_env(cls) -> 'AppConfig':
        """Crée la configuration à partir des variables d'environnement"""
        
        env = Environment(os.getenv("ENVIRONMENT", "development"))
        
        # Configuration de base selon l'environnement
        if env == Environment.DEVELOPMENT:
            debug = True
            log_level = "DEBUG"
        elif env == Environment.STAGING:
            debug = False
            log_level = "INFO"
        else:  # PRODUCTION
            debug = False
            log_level = "WARNING"
        
        # Configuration de la base de données
        database = DatabaseConfig(
            host=os.getenv("DB_HOST", "localhost"),
            port=int(os.getenv("DB_PORT", "5432")),
            name=os.getenv("DB_NAME", "myapp"),
            user=os.getenv("DB_USER", "postgres"),
            password=os.getenv("DB_PASSWORD", ""),
            ssl_mode=os.getenv("DB_SSL_MODE", "prefer")
        )
        
        return cls(
            environment=env,
            debug=debug,
            log_level=log_level,
            database=database,
            redis_url=os.getenv("REDIS_URL", "redis://localhost:6379/0"),
            secret_key=os.getenv("SECRET_KEY", "dev-secret-key")
        )
    
    def validate(self) -> None:
        """Valide la configuration"""
        if self.environment == Environment.PRODUCTION:
            if self.secret_key == "dev-secret-key":
                raise ValueError("SECRET_KEY par défaut en production !")
            
            if not self.database.password:
                raise ValueError("Mot de passe DB requis en production")
            
            if self.debug:
                raise ValueError("Debug activé en production !")

# Utilisation
config = AppConfig.from_env()
config.validate()