"""Authentication middleware — API key based."""

from __future__ import annotations

import logging
import secrets

from fastapi import HTTPException, Request

from hermes.config.settings import get_settings

logger = logging.getLogger(__name__)


async def get_api_key_dependency(request: Request) -> None:
    """Evaluated at request-time so env/config changes take effect without module reload."""
    settings = get_settings()
    if not settings.security.enable_auth or not settings.security.api_key:
        return
    auth_header = request.headers.get("Authorization", "")
    if not auth_header.startswith("Bearer "):
        raise HTTPException(status_code=401, detail="Missing or malformed Authorization header")
    provided = auth_header.removeprefix("Bearer ")
    expected = settings.security.api_key
    if not secrets.compare_digest(provided, expected):
        raise HTTPException(status_code=401, detail="Invalid API key")