import uuid

from fastapi import HTTPException, Request

from app.services.google_auth import decode_full_jwt
from app.utils.config import get_config

config = get_config()


def require_admin_jwt(request: Request) -> uuid.UUID:
    token = request.cookies.get("access_token")
    if not token:
        raise HTTPException(status_code=401, detail="Unauthorized")

    try:
        tenant_id_str = decode_full_jwt(token, config.jwt_secret_key)
        tenant_id = uuid.UUID(tenant_id_str)
    except (ValueError, AttributeError):
        raise HTTPException(status_code=401, detail="Unauthorized")

    request.state.tenant_id = tenant_id
    return tenant_id