"""Shared authorization for all state-changing HTTP endpoints."""

from __future__ import annotations

import hmac
import os

from fastapi import Header, HTTPException, status


def require_pipeline_guid(x_pipeline_guid: str | None = Header(default=None)) -> None:
    expected = os.getenv("PIPELINE_ADMIN_GUID")
    if not expected or not x_pipeline_guid or not hmac.compare_digest(x_pipeline_guid, expected):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Unauthorized")