"""
LectureLens — API Key Authentication
Provides a FastAPI Dependency that validates the X-API-Key header.
"""

from fastapi import Depends, Header, HTTPException, status
from fastapi.security import APIKeyHeader

from app.config import Settings, get_settings

_API_KEY_SCHEME = APIKeyHeader(name="X-API-Key", auto_error=False)


async def verify_api_key(
    api_key: str | None = Depends(_API_KEY_SCHEME),
    settings: Settings = Depends(get_settings),
) -> None:
    """
    FastAPI dependency — raise HTTP 401 if the X-API-Key header is
    missing or does not match the configured secret.
    """
    if not api_key or api_key != settings.lecturelens_api_key:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail={
                "error_code": "UNAUTHORIZED",
                "detail": "Missing or invalid X-API-Key header.",
            },
            headers={"WWW-Authenticate": "ApiKey"},
        )