app/security.py

import os
import secrets
from fastapi import Header, HTTPException, status


ROBOT_API_KEY = os.getenv("ROBOT_API_KEY", "")


def require_api_key(x_api_key: str | None = Header(default=None)):
    """
    Simple API-key protection for dangerous robot endpoints.

    Client must send:
      X-API-Key: your_secret_key
    """
    if not ROBOT_API_KEY:
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail="Server ROBOT_API_KEY is not configured",
        )

    if not x_api_key or not secrets.compare_digest(x_api_key, ROBOT_API_KEY):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or missing API key",
        )

    return True