#!/usr/bin/env python3
"""API authentication."""
from typing import Optional
from fastapi import HTTPException, Header, status

from config import API_KEY
from logger import setup_logger

logger = setup_logger("security.auth")

async def verify_bearer_token(authorization: Optional[str] = Header(None)) -> str:
    """Verify Bearer token."""
    if not API_KEY:
        logger.error("MED_SERVICE_KEY is not configured")
        raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="Service authentication is not configured")

    if not authorization:
        logger.warning("Missing Authorization header")
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing Authorization")
    
    if not authorization.startswith("Bearer "):
        logger.warning("Invalid Authorization format")
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid format")
    
    token = authorization.replace("Bearer ", "", 1).strip()
    
    if token != API_KEY:
        logger.warning("Invalid API key attempt")
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid API key")
    
    return token