# app/dependencies/auth.py

from fastapi import HTTPException, Request, status
from app.services.AuthService import AuthService
from app.core.config import settings


def get_current_user(request: Request):
    auth_header = request.headers.get("Authorization")
    if not auth_header or not auth_header.startswith("Bearer "):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Token no proporcionado")

    token = auth_header.split(" ")[1]
    user_payload = AuthService.validate_token(token)
    return user_payload


def require_internal(request: Request, user: dict = None):
    """
    Valida que la request incluya el header X-Internal-Key correcto.
    Combinar con get_current_user para rutas que requieren JWT + key de operación.
    """
    api_key = request.headers.get("X-Internal-Key")
    if not api_key or api_key != settings.INTERNAL_API_KEY:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
                            detail="Acceso restringido a operaciones internas")