# app/auth.py
"""
Authorization dependency.
"""

from fastapi import Request, HTTPException, status, Header
from .config import settings
from .logger import logger


async def api_key_guard(
    request: Request,
    x_api_key: str = Header(..., alias="x-api-key", description="API Key for authentication"),
) -> None:
    # Check API key
    # FastAPI's Header(...) ensures the key is present. behavior if missing is 422.
    # We still check the value.
    if x_api_key != settings.EMBED_API_KEY:
        logger.warning(f"Unauthorized: Invalid API key. Provided: {x_api_key[:4] if x_api_key else 'None'}...")
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid API key")

    logger.debug(f"Auth passed for request from {request.client.host if request.client else 'unknown'}")