import os
import secrets
from typing import Annotated
from fastapi import Depends, HTTPException
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

bearer = HTTPBearer(auto_error=False, scheme_name='FinanceAPIToken',
                    description='Bearer-Token aus FINANCE_API_TOKEN. Kein Standard-Token.')


def require_token(credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(bearer)]):
    token = os.environ.get('FINANCE_API_TOKEN', '')
    if not token.strip() or token == 'change-me':
        raise HTTPException(503, 'API nicht konfiguriert. FINANCE_API_TOKEN muss gesetzt werden.')
    if credentials is None or not secrets.compare_digest(credentials.credentials.encode(), token.encode()):
        raise HTTPException(401, 'Fehlendes oder ungültiges API-Token.', headers={'WWW-Authenticate': 'Bearer'})