"""FastAPI auth dependencies."""

from __future__ import annotations

from fastapi import Depends, Header, HTTPException, status

from app.auth.supabase_client import AuthUser, verify_access_token
from app.config import AUTH_ENABLED


def _bearer_token(authorization: str | None) -> str:
    if not authorization:
        return ""
    parts = authorization.split(" ", 1)
    if len(parts) != 2 or parts[0].lower() != "bearer":
        return ""
    return parts[1].strip()


async def optional_user(
    authorization: str | None = Header(default=None),
) -> AuthUser | None:
    if not AUTH_ENABLED:
        return None
    token = _bearer_token(authorization)
    if not token:
        return None
    try:
        return verify_access_token(token)
    except HTTPException:
        # Expired/invalid tokens should not break public/preview endpoints
        return None


async def require_user(
    authorization: str | None = Header(default=None),
) -> AuthUser | None:
    """Require a logged-in user when auth is enabled; otherwise allow open access."""
    if not AUTH_ENABLED:
        return None
    token = _bearer_token(authorization)
    if not token:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Sign in to rewrite text.",
            headers={"WWW-Authenticate": "Bearer"},
        )
    return verify_access_token(token)


# Alias for readability at call sites
CurrentUser = Depends(require_user)