import secrets as _secrets

from fastapi import HTTPException, Security
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials

from backend.dependencies.auth import get_or_create_master_token

security = HTTPBearer()

async def verify_token(credentials: HTTPAuthorizationCredentials = Security(security)):
    # S4: unified with the middleware token (JARVIS_CLOUD_TOKEN on the Space,
    # persisted file token locally). The old hardcoded fallback lived in a public
    # repo, which made it no auth at all — resolved lazily so env set at boot wins.
    if credentials.scheme != "Bearer":
        raise HTTPException(status_code=401, detail="Invalid authentication scheme.")
    if not _secrets.compare_digest(credentials.credentials, get_or_create_master_token()):
        raise HTTPException(status_code=401, detail="Invalid API Token.")
    return credentials.credentials