config.py

# config.py
import logging
import os
import requests
import uuid
import tempfile
import json
import time
import threading
import random
import base64
import markdown2
import re
import docx
import fitz # PyMuPDF
import math
import mimetypes
import openpyxl
import xlrd
import traceback
import subprocess
import ffmpeg_binaries as ffmpeg_bin
ffmpeg_bin.init()
import ffmpeg as ffmpeg_py
import glob
import jwt
import pandas

# Add dotenv import
from dotenv import load_dotenv

from flask import (
    Flask, 
    flash, 
    request, 
    jsonify, 
    render_template, 
    redirect, 
    url_for, 
    session, 
    send_from_directory, 
    send_file, 
    Markup,
    current_app
)
from werkzeug.utils import secure_filename
from datetime import datetime, timezone, timedelta
from functools import wraps
from msal import ConfidentialClientApplication, SerializableTokenCache
from flask_session import Session
from uuid import uuid4
from threading import Thread
from openai import AzureOpenAI, RateLimitError
from cryptography.fernet import Fernet, InvalidToken
from urllib.parse import quote
from flask_executor import Executor
from bs4 import BeautifulSoup
from langchain_text_splitters import (
    RecursiveCharacterTextSplitter,
    MarkdownHeaderTextSplitter,
    RecursiveJsonSplitter
)
from PIL import Image
from io import BytesIO
from typing import List

from azure.cosmos import CosmosClient, PartitionKey, exceptions
from azure.cosmos.exceptions import CosmosResourceNotFoundError
from azure.core.credentials import AzureKeyCredential
from azure.ai.documentintelligence import DocumentIntelligenceClient
from azure.ai.formrecognizer import DocumentAnalysisClient
from azure.search.documents import SearchClient, IndexDocumentsBatch
from azure.search.documents.models import VectorizedQuery
from azure.search.documents.indexes import SearchIndexClient
from azure.search.documents.indexes.models import SearchIndex, SearchField, SearchFieldDataType
from azure.core.exceptions import AzureError, ResourceNotFoundError, HttpResponseError, ServiceRequestError
from azure.core.polling import LROPoller
from azure.mgmt.cognitiveservices import CognitiveServicesManagementClient
from azure.identity import ClientSecretCredential, DefaultAzureCredential, get_bearer_token_provider, AzureAuthorityHosts
from azure.ai.contentsafety import ContentSafetyClient
from azure.ai.contentsafety.models import AnalyzeTextOptions, TextCategory
from azure.storage.blob import BlobServiceClient, generate_blob_sas, BlobSasPermissions

# Load environment variables from .env file
load_dotenv()

# Flask app configuration constants
EXECUTOR_TYPE = 'thread'
EXECUTOR_MAX_WORKERS = 30
SESSION_TYPE = 'filesystem'
VERSION = "0.237.011"

SECRET_KEY = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production')

# Security Headers Configuration
SECURITY_HEADERS = {
    'X-Content-Type-Options': 'nosniff',
    'X-Frame-Options': 'DENY',
    'X-XSS-Protection': '1; mode=block',
    'Referrer-Policy': 'strict-origin-when-cross-origin',
    'Content-Security-Policy': (
        "default-src 'self'; "
        "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
        #"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://code.jquery.com https://stackpath.bootstrapcdn.com; "
        "style-src 'self' 'unsafe-inline'; "
        #"style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://stackpath.bootstrapcdn.com; "
        "img-src 'self' data: https: blob:; "
        "font-src 'self'; "
        #"font-src 'self' https://cdn.jsdelivr.net https://stackpath.bootstrapcdn.com; "
        "connect-src 'self' https: wss: ws:; "
        "media-src 'self' blob:; "
        "object-src 'none'; "
        "frame-ancestors 'self'; "
        "base-uri 'self';"
    )
}

# Security Configuration
ENABLE_STRICT_TRANSPORT_SECURITY = os.getenv('ENABLE_HSTS', 'false').lower() == 'true'
HSTS_MAX_AGE = int(os.getenv('HSTS_MAX_AGE', '31536000'))  # 1 year default

CLIENTS = {}
CLIENTS_LOCK = threading.Lock()

# Base allowed extensions (always available)
BASE_ALLOWED_EXTENSIONS = {'txt', 'doc', 'docm', 'html', 'md', 'json', 'xml', 'yaml', 'yml', 'log'}
DOCUMENT_EXTENSIONS = {'pdf', 'docx', 'pptx', 'ppt'}
TABULAR_EXTENSIONS = {'csv', 'xlsx', 'xls', 'xlsm'}

# Updates to image, video, or audio extensions should also be made in static/js/chat/chat-enhanced-citations.js if the new file types can be natively rendered in the browser.
IMAGE_EXTENSIONS = {'jpg', 'jpeg', 'png', 'bmp', 'tiff', 'tif', 'heif', 'heic'}

# Optional extensions by feature
VIDEO_EXTENSIONS = {
    'mp4', 'mov', 'avi', 'mkv', 'flv', 'mxf', 'gxf', 'ts', 'ps', '3gp', '3gpp',
    'mpg', 'wmv', 'asf', 'm4v', 'isma', 'ismv', 'dvr-ms', 'webm', 'mpeg'
}

AUDIO_EXTENSIONS = {'mp3', 'wav', 'ogg', 'aac', 'flac', 'm4a'}

def get_allowed_extensions(enable_video=False, enable_audio=False):
    """
    Get allowed file extensions based on feature flags.
    
    Args:
        enable_video: Whether video file support is enabled
        enable_audio: Whether audio file support is enabled
        
    Returns:
        set: Allowed file extensions
    """
    extensions = BASE_ALLOWED_EXTENSIONS.copy()
    extensions.update(DOCUMENT_EXTENSIONS)
    extensions.update(IMAGE_EXTENSIONS)
    extensions.update(TABULAR_EXTENSIONS)

    if enable_video:
        extensions.update(VIDEO_EXTENSIONS)

    if enable_audio:
        extensions.update(AUDIO_EXTENSIONS)

    return extensions

ALLOWED_EXTENSIONS = get_allowed_extensions(enable_video=True, enable_audio=True)

# Admin UI specific extensions (for logo/favicon uploads)
ALLOWED_EXTENSIONS_IMG = {'png', 'jpg', 'jpeg'}
MAX_CONTENT_LENGTH = 5000 * 1024 * 1024  # 5000 MB AKA 5 GB

# Add Support for Custom Azure Environments
CUSTOM_GRAPH_URL_VALUE = os.getenv("CUSTOM_GRAPH_URL_VALUE", "").rstrip('/')
CUSTOM_IDENTITY_URL_VALUE = os.getenv("CUSTOM_IDENTITY_URL_VALUE", "").rstrip('/')
CUSTOM_RESOURCE_MANAGER_URL_VALUE = os.getenv("CUSTOM_RESOURCE_MANAGER_URL_VALUE", "").rstrip('/')
CUSTOM_BLOB_STORAGE_URL_VALUE = os.getenv("CUSTOM_BLOB_STORAGE_URL_VALUE", "").rstrip('/')
CUSTOM_COGNITIVE_SERVICES_URL_VALUE = os.getenv("CUSTOM_COGNITIVE_SERVICES_URL_VALUE", "")
CUSTOM_SEARCH_RESOURCE_MANAGER_URL_VALUE = os.getenv("CUSTOM_SEARCH_RESOURCE_MANAGER_URL_VALUE", "")
CUSTOM_REDIS_CACHE_INFRASTRUCTURE_URL_VALUE = os.getenv("CUSTOM_REDIS_CACHE_INFRASTRUCTURE_URL_VALUE", "")
CUSTOM_OIDC_METADATA_URL_VALUE = os.getenv("CUSTOM_OIDC_METADATA_URL_VALUE", "")

# Azure AD Configuration
CLIENT_ID = os.getenv("CLIENT_ID")
APP_URI = f"api://{CLIENT_ID}"
CLIENT_SECRET = os.getenv("MICROSOFT_PROVIDER_AUTHENTICATION_SECRET")
TENANT_ID = os.getenv("TENANT_ID")
SCOPE = ["User.Read", "User.ReadBasic.All", "People.Read.All", "Group.Read.All"] # Adjust scope according to your needs
MICROSOFT_PROVIDER_AUTHENTICATION_SECRET = os.getenv("MICROSOFT_PROVIDER_AUTHENTICATION_SECRET")
LOGIN_REDIRECT_URL = os.getenv("LOGIN_REDIRECT_URL")
HOME_REDIRECT_URL = os.getenv("HOME_REDIRECT_URL")  # Front Door URL for home page

OIDC_METADATA_URL = f"https://login.microsoftonline.com/{TENANT_ID}/v2.0/.well-known/openid-configuration"
AZURE_ENVIRONMENT = os.getenv("AZURE_ENVIRONMENT", "public") # public, usgovernment, custom

if AZURE_ENVIRONMENT == "custom":
    AUTHORITY = f"{CUSTOM_IDENTITY_URL_VALUE.rstrip('/')}/{TENANT_ID}"
elif AZURE_ENVIRONMENT == "usgovernment":
    AUTHORITY = f"https://login.microsoftonline.us/{TENANT_ID}"
else:
    AUTHORITY = f"https://login.microsoftonline.com/{TENANT_ID}"

WORD_CHUNK_SIZE = 400

if AZURE_ENVIRONMENT == "usgovernment":
    OIDC_METADATA_URL = f"https://login.microsoftonline.us/{TENANT_ID}/v2.0/.well-known/openid-configuration"
    resource_manager = "https://management.usgovcloudapi.net"
    authority = AzureAuthorityHosts.AZURE_GOVERNMENT
    credential_scopes=[resource_manager + "/.default"]
    cognitive_services_scope = "https://cognitiveservices.azure.us/.default"
    video_indexer_endpoint = "https://api.videoindexer.ai.azure.us"
    search_resource_manager = "https://search.azure.us"
    KEY_VAULT_DOMAIN = ".vault.usgovcloudapi.net"

elif AZURE_ENVIRONMENT == "custom":
    OIDC_METADATA_URL = CUSTOM_OIDC_METADATA_URL_VALUE
    resource_manager = CUSTOM_RESOURCE_MANAGER_URL_VALUE
    authority = CUSTOM_IDENTITY_URL_VALUE
    credential_scopes=[resource_manager + "/.default"]
    cognitive_services_scope = CUSTOM_COGNITIVE_SERVICES_URL_VALUE  
    search_resource_manager = CUSTOM_SEARCH_RESOURCE_MANAGER_URL_VALUE
    KEY_VAULT_DOMAIN = os.getenv("KEY_VAULT_DOMAIN", ".vault.azure.net")
    video_indexer_endpoint = os.getenv("VIDEO_INDEXER_ENDPOINT", "https://api.videoindexer.ai")
else:
    OIDC_METADATA_URL = f"https://login.microsoftonline.com/{TENANT_ID}/v2.0/.well-known/openid-configuration"
    resource_manager = "https://management.azure.com"
    authority = AzureAuthorityHosts.AZURE_PUBLIC_CLOUD
    credential_scopes=[resource_manager + "/.default"]
    cognitive_services_scope = "https://cognitiveservices.azure.com/.default"
    video_indexer_endpoint = "https://api.videoindexer.ai"
    KEY_VAULT_DOMAIN = ".vault.azure.net"

def get_redis_cache_infrastructure_endpoint(redis_hostname: str) -> str:
    """
    Get the appropriate Redis cache infrastructure endpoint based on Azure environment.
    
    Args:
        redis_hostname (str): The hostname of the Redis cache instance
        
    Returns:
        str: The complete endpoint URL for Redis cache infrastructure token acquisition
    """
    if AZURE_ENVIRONMENT == "usgovernment":
        return f"https://{redis_hostname}.cacheinfra.azure.us:10225/appid"
    elif AZURE_ENVIRONMENT == "custom" and CUSTOM_REDIS_CACHE_INFRASTRUCTURE_URL_VALUE:
        # For custom environments, allow override via environment variable
        # Format: https://{hostname}.custom-cache-domain.com:10225/appid
        return CUSTOM_REDIS_CACHE_INFRASTRUCTURE_URL_VALUE.format(hostname=redis_hostname)
    else:
        # Default to Azure Public Cloud
        return f"https://{redis_hostname}.cacheinfra.windows.net:10225/appid"
    

storage_account_user_documents_container_name = "user-documents"
storage_account_group_documents_container_name = "group-documents"
storage_account_public_documents_container_name = "public-documents"

# Initialize Azure Cosmos DB client
cosmos_endpoint = os.getenv("AZURE_COSMOS_ENDPOINT")
cosmos_key = os.getenv("AZURE_COSMOS_KEY")
cosmos_authentication_type = os.getenv("AZURE_COSMOS_AUTHENTICATION_TYPE", "key") #key or managed_identity

if cosmos_authentication_type == "managed_identity":
    cosmos_client = CosmosClient(cosmos_endpoint, credential=DefaultAzureCredential(), consistency_level="Session")
else:
    cosmos_client = CosmosClient(cosmos_endpoint, cosmos_key, consistency_level="Session")

cosmos_database_name = "SimpleChat"
cosmos_database = cosmos_client.create_database_if_not_exists(cosmos_database_name)

cosmos_conversations_container_name = "conversations"
cosmos_conversations_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_conversations_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_messages_container_name = "messages"
cosmos_messages_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_messages_container_name,
    partition_key=PartitionKey(path="/conversation_id")
)

cosmos_group_conversations_container_name = "group_conversations"
cosmos_group_conversations_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_group_conversations_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_group_messages_container_name = "group_messages"
cosmos_group_messages_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_group_messages_container_name,
    partition_key=PartitionKey(path="/conversation_id")
)

cosmos_settings_container_name = "settings"
cosmos_settings_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_settings_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_groups_container_name = "groups"
cosmos_groups_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_groups_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_public_workspaces_container_name = "public_workspaces"
cosmos_public_workspaces_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_public_workspaces_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_user_documents_container_name = "documents"
cosmos_user_documents_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_user_documents_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_group_documents_container_name = "group_documents"
cosmos_group_documents_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_group_documents_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_public_documents_container_name = "public_documents"
cosmos_public_documents_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_public_documents_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_user_settings_container_name = "user_settings"
cosmos_user_settings_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_user_settings_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_safety_container_name = "safety"
cosmos_safety_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_safety_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_feedback_container_name = "feedback"
cosmos_feedback_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_feedback_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_archived_conversations_container_name = "archived_conversations"
cosmos_archived_conversations_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_archived_conversations_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_archived_messages_container_name = "archived_messages"
cosmos_archived_messages_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_archived_messages_container_name,
    partition_key=PartitionKey(path="/conversation_id")
)

cosmos_user_prompts_container_name = "prompts"
cosmos_user_prompts_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_user_prompts_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_group_prompts_container_name = "group_prompts"
cosmos_group_prompts_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_group_prompts_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_public_prompts_container_name = "public_prompts"
cosmos_public_prompts_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_public_prompts_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_file_processing_container_name = "file_processing"
cosmos_file_processing_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_file_processing_container_name,
    partition_key=PartitionKey(path="/document_id")
)

cosmos_personal_agents_container_name = "personal_agents"
cosmos_personal_agents_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_personal_agents_container_name,
    partition_key=PartitionKey(path="/user_id")
)

cosmos_personal_actions_container_name = "personal_actions"
cosmos_personal_actions_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_personal_actions_container_name,
    partition_key=PartitionKey(path="/user_id")
)

cosmos_group_agents_container_name = "group_agents"
cosmos_group_agents_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_group_agents_container_name,
    partition_key=PartitionKey(path="/group_id")
)

cosmos_group_actions_container_name = "group_actions"
cosmos_group_actions_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_group_actions_container_name,
    partition_key=PartitionKey(path="/group_id")
)

cosmos_global_agents_container_name = "global_agents"
cosmos_global_agents_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_global_agents_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_global_actions_container_name = "global_actions"
cosmos_global_actions_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_global_actions_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_agent_templates_container_name = "agent_templates"
cosmos_agent_templates_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_agent_templates_container_name,
    partition_key=PartitionKey(path="/id")
)

cosmos_agent_facts_container_name = "agent_facts"
cosmos_agent_facts_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_agent_facts_container_name,
    partition_key=PartitionKey(path="/scope_id")
)

cosmos_search_cache_container_name = "search_cache"
cosmos_search_cache_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_search_cache_container_name,
    partition_key=PartitionKey(path="/user_id")
)

cosmos_activity_logs_container_name = "activity_logs"
cosmos_activity_logs_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_activity_logs_container_name,
    partition_key=PartitionKey(path="/user_id")
)

cosmos_notifications_container_name = "notifications"
cosmos_notifications_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_notifications_container_name,
    partition_key=PartitionKey(path="/user_id"),
    default_ttl=-1  # TTL disabled by default, enabled per-document
)

cosmos_approvals_container_name = "approvals"
cosmos_approvals_container = cosmos_database.create_container_if_not_exists(
    id=cosmos_approvals_container_name,
    partition_key=PartitionKey(path="/group_id"),
    default_ttl=-1  # TTL disabled by default, enabled per-document for auto-cleanup
)

def ensure_custom_logo_file_exists(app, settings):
    """
    If custom_logo_base64 or custom_logo_dark_base64 is present in settings, ensure the appropriate
    static files exist and reflect the current base64 data. Overwrites if necessary.
    If base64 is empty/missing, removes the corresponding file.
    """
    # Handle light mode logo
    custom_logo_b64 = settings.get('custom_logo_base64', '')
    logo_filename = 'custom_logo.png'
    logo_path = os.path.join(app.root_path, 'static', 'images', logo_filename)
    images_dir = os.path.dirname(logo_path)

    # Ensure the directory exists
    os.makedirs(images_dir, exist_ok=True)

    if not custom_logo_b64:
        # No custom logo in DB; remove the static file if it exists
        if os.path.exists(logo_path):
            try:
                os.remove(logo_path)
                print(f"Removed existing {logo_filename} as custom logo is disabled/empty.")
            except OSError as ex:
                print(f"Error removing {logo_filename}: {ex}")
    else:
        # Custom logo exists in settings, write/overwrite the file
        try:
            # Decode the current base64 string
            decoded = base64.b64decode(custom_logo_b64)

            # Write the decoded data to the file, overwriting if it exists
            with open(logo_path, 'wb') as f:
                f.write(decoded)
            print(f"Ensured {logo_filename} exists and matches current settings.")

        except (base64.binascii.Error, TypeError, OSError) as ex:
            print(f"Failed to write/overwrite {logo_filename}: {ex}")
        except Exception as ex:
            print(f"Unexpected error writing {logo_filename}: {ex}")

    # Handle dark mode logo
    custom_logo_dark_b64 = settings.get('custom_logo_dark_base64', '')
    logo_dark_filename = 'custom_logo_dark.png'
    logo_dark_path = os.path.join(app.root_path, 'static', 'images', logo_dark_filename)

    if not custom_logo_dark_b64:
        # No custom dark logo in DB; remove the static file if it exists
        if os.path.exists(logo_dark_path):
            try:
                os.remove(logo_dark_path)
                print(f"Removed existing {logo_dark_filename} as custom dark logo is disabled/empty.")
            except OSError as ex:
                print(f"Error removing {logo_dark_filename}: {ex}")
    else:
        # Custom dark logo exists in settings, write/overwrite the file
        try:
            # Decode the current base64 string
            decoded = base64.b64decode(custom_logo_dark_b64)

            # Write the decoded data to the file, overwriting if it exists
            with open(logo_dark_path, 'wb') as f:
                f.write(decoded)
            print(f"Ensured {logo_dark_filename} exists and matches current settings.")

        except (base64.binascii.Error, TypeError, OSError) as ex:
            print(f"Failed to write/overwrite {logo_dark_filename}: {ex}")
        except Exception as ex:
            print(f"Unexpected error writing {logo_dark_filename}: {ex}")

def ensure_custom_favicon_file_exists(app, settings):
    """
    If custom_favicon_base64 is present in settings, ensure static/images/favicon.ico
    exists and reflects the current base64 data. Overwrites if necessary.
    If base64 is empty/missing, uses the default favicon.
    """
    custom_favicon_b64 = settings.get('custom_favicon_base64', '')
    # Ensure the filename is consistent
    favicon_filename = 'favicon.ico'
    favicon_path = os.path.join(app.root_path, 'static', 'images', favicon_filename)
    images_dir = os.path.dirname(favicon_path)

    # Ensure the directory exists
    os.makedirs(images_dir, exist_ok=True)

    if not custom_favicon_b64:
        # No custom favicon in DB; no need to remove the static file as we want to keep the default
        return

    # Custom favicon exists in settings, write/overwrite the file
    try:
        # Decode the current base64 string
        decoded = base64.b64decode(custom_favicon_b64)

        # Write the decoded data to the file, overwriting if it exists
        with open(favicon_path, 'wb') as f:
            f.write(decoded)
        print(f"Ensured {favicon_filename} exists and matches current settings.")

    except (base64.binascii.Error, TypeError, OSError) as ex: # Catch specific errors
        print(f"Failed to write/overwrite {favicon_filename}: {ex}")
    except Exception as ex: # Catch any other unexpected errors
         print(f"Unexpected error during favicon file write for {favicon_filename}: {ex}")

def initialize_clients(settings):
    """
    Initialize/re-initialize all your clients based on the provided settings.
    Store them in a global dictionary so they're accessible throughout the app.
    """
    with CLIENTS_LOCK:
        form_recognizer_endpoint = settings.get("azure_document_intelligence_endpoint")
        form_recognizer_key = settings.get("azure_document_intelligence_key")
        enable_document_intelligence_apim = settings.get("enable_document_intelligence_apim")
        azure_apim_document_intelligence_endpoint = settings.get("azure_apim_document_intelligence_endpoint")
        azure_apim_document_intelligence_subscription_key = settings.get("azure_apim_document_intelligence_subscription_key")

        azure_ai_search_endpoint = settings.get("azure_ai_search_endpoint")
        azure_ai_search_key = settings.get("azure_ai_search_key")
        enable_ai_search_apim = settings.get("enable_ai_search_apim")
        azure_apim_ai_search_endpoint = settings.get("azure_apim_ai_search_endpoint")
        azure_apim_ai_search_subscription_key = settings.get("azure_apim_ai_search_subscription_key")

        enable_enhanced_citations = settings.get("enable_enhanced_citations")
        enable_video_file_support = settings.get("enable_video_file_support")
        enable_audio_file_support = settings.get("enable_audio_file_support")

        try:
            if enable_document_intelligence_apim:
                document_intelligence_client = DocumentIntelligenceClient(
                    endpoint=azure_apim_document_intelligence_endpoint,
                    credential=AzureKeyCredential(azure_apim_document_intelligence_subscription_key)
                )
            else:
                if settings.get("azure_document_intelligence_authentication_type") == "managed_identity":
                    if AZURE_ENVIRONMENT in ("usgovernment", "custom"):
                        document_intelligence_client = DocumentIntelligenceClient(
                            endpoint=form_recognizer_endpoint,
                            credential=DefaultAzureCredential(),
                            credential_scopes=[cognitive_services_scope],
                            api_version="2024-11-30"
                        )
                    else:
                        document_intelligence_client = DocumentIntelligenceClient(
                            endpoint=form_recognizer_endpoint,
                            credential=DefaultAzureCredential()
                        )
                else:
                    document_intelligence_client = DocumentIntelligenceClient(
                        endpoint=form_recognizer_endpoint,
                        credential=AzureKeyCredential(form_recognizer_key)
                    )
            CLIENTS["document_intelligence_client"] = document_intelligence_client
        except Exception as e:
            print(f"Failed to initialize Document Intelligence client: {e}")

        try:
            if enable_ai_search_apim:
                search_client_user = SearchClient(
                    endpoint=azure_apim_ai_search_endpoint,
                    index_name="simplechat-user-index",
                    credential=AzureKeyCredential(azure_apim_ai_search_subscription_key)
                )
                search_client_group = SearchClient(
                    endpoint=azure_apim_ai_search_endpoint,
                    index_name="simplechat-group-index",
                    credential=AzureKeyCredential(azure_apim_ai_search_subscription_key)
                )
                search_client_public = SearchClient(
                    endpoint=azure_apim_ai_search_endpoint,
                    index_name="simplechat-public-index",
                    credential=AzureKeyCredential(azure_apim_ai_search_subscription_key)
                )
            else:
                if settings.get("azure_ai_search_authentication_type") == "managed_identity":
                    if AZURE_ENVIRONMENT in ("usgovernment", "custom"):
                        search_client_user = SearchClient(
                            endpoint=azure_ai_search_endpoint,
                            index_name="simplechat-user-index",
                            credential=DefaultAzureCredential(),
                            audience=search_resource_manager
                        )
                        search_client_group = SearchClient(
                            endpoint=azure_ai_search_endpoint,
                            index_name="simplechat-group-index",
                            credential=DefaultAzureCredential(),
                            audience=search_resource_manager
                        )
                        search_client_public = SearchClient(
                            endpoint=azure_ai_search_endpoint,
                            index_name="simplechat-public-index",
                            credential=DefaultAzureCredential(),
                            audience=search_resource_manager
                        )
                    else:
                        search_client_user = SearchClient(
                            endpoint=azure_ai_search_endpoint,
                            index_name="simplechat-user-index",
                            credential=DefaultAzureCredential()
                        )
                        search_client_group = SearchClient(
                            endpoint=azure_ai_search_endpoint,
                            index_name="simplechat-group-index",
                            credential=DefaultAzureCredential()
                        )
                        search_client_public = SearchClient(
                            endpoint=azure_ai_search_endpoint,
                            index_name="simplechat-public-index",
                            credential=DefaultAzureCredential()
                        )
                else:
                    search_client_user = SearchClient(
                        endpoint=azure_ai_search_endpoint,
                        index_name="simplechat-user-index",
                        credential=AzureKeyCredential(azure_ai_search_key)
                    )
                    search_client_group = SearchClient(
                        endpoint=azure_ai_search_endpoint,
                        index_name="simplechat-group-index",
                        credential=AzureKeyCredential(azure_ai_search_key)
                    )
                    search_client_public = SearchClient(
                        endpoint=azure_ai_search_endpoint,
                        index_name="simplechat-public-index",
                        credential=AzureKeyCredential(azure_ai_search_key)
                    )
            CLIENTS["search_client_user"] = search_client_user
            CLIENTS["search_client_group"] = search_client_group
            CLIENTS["search_client_public"] = search_client_public
        except Exception as e:
            print(f"Failed to initialize Search clients: {e}")

        if settings.get("enable_content_safety"):
            safety_endpoint = settings.get("content_safety_endpoint", "")
            safety_key = settings.get("content_safety_key", "")
            enable_content_safety_apim = settings.get("enable_content_safety_apim")
            azure_apim_content_safety_endpoint = settings.get("azure_apim_content_safety_endpoint")
            azure_apim_content_safety_subscription_key = settings.get("azure_apim_content_safety_subscription_key")

            if safety_endpoint:
                try:
                    if enable_content_safety_apim:
                        content_safety_client = ContentSafetyClient(
                            endpoint=azure_apim_content_safety_endpoint,
                            credential=AzureKeyCredential(azure_apim_content_safety_subscription_key)
                        )
                    else:
                        if settings.get("content_safety_authentication_type") == "managed_identity":
                            if AZURE_ENVIRONMENT in ("usgovernment", "custom"):
                                content_safety_client = ContentSafetyClient(
                                    endpoint=safety_endpoint,
                                    credential=DefaultAzureCredential(),
                                    credential_scopes=[cognitive_services_scope]
                                )
                            else:
                                content_safety_client = ContentSafetyClient(
                                    endpoint=safety_endpoint,
                                    credential=DefaultAzureCredential()
                                )
                        else:
                            content_safety_client = ContentSafetyClient(
                                endpoint=safety_endpoint,
                                credential=AzureKeyCredential(safety_key)
                            )
                    CLIENTS["content_safety_client"] = content_safety_client
                except Exception as e:
                    print(f"Failed to initialize Content Safety client: {e}")
                    CLIENTS["content_safety_client"] = None
            else:
                print("Content Safety enabled, but endpoint/key not provided.")
        else:
            if "content_safety_client" in CLIENTS:
                del CLIENTS["content_safety_client"]


        try:
            if enable_enhanced_citations:
                blob_service_client = None
                if settings.get("office_docs_authentication_type") == "key":
                    blob_service_client = BlobServiceClient.from_connection_string(settings.get("office_docs_storage_account_url"))
                    CLIENTS["storage_account_office_docs_client"] = blob_service_client
                elif settings.get("office_docs_authentication_type") == "managed_identity":
                    blob_service_client = BlobServiceClient(account_url=settings.get("office_docs_storage_account_blob_endpoint"), credential=DefaultAzureCredential())
                    CLIENTS["storage_account_office_docs_client"] = blob_service_client
                
                # Create containers if they don't exist
                # This addresses the issue where the application assumes containers exist
                if blob_service_client:
                    for container_name in [
                        storage_account_user_documents_container_name, 
                        storage_account_group_documents_container_name, 
                        storage_account_public_documents_container_name
                        ]:
                        try:
                            container_client = blob_service_client.get_container_client(container_name)
                            if not container_client.exists():
                                print(f"Container '{container_name}' does not exist. Creating...")
                                container_client.create_container()
                                print(f"Container '{container_name}' created successfully.")
                            else:
                                print(f"Container '{container_name}' already exists.")
                        except Exception as container_error:
                            print(f"Error creating container {container_name}: {str(container_error)}")
        except Exception as e:
            print(f"Failed to initialize Blob Storage clients: {e}")