from __future__ import annotations

import base64
import hmac
import os

from fastapi import Request
from fastapi.responses import JSONResponse, Response


def _unauthorized() -> Response:
    return JSONResponse(
        status_code=401,
        content={"detail": "Anmeldung erforderlich."},
        headers={"WWW-Authenticate": 'Basic realm="Tandoor AI Import"'},
    )


async def basic_auth_middleware(request: Request, call_next):
    expected_password = os.environ.get("APP_PASSWORD", "")
    if not expected_password:
        return await call_next(request)

    expected_username = os.environ.get("APP_USERNAME", "admin")
    header = request.headers.get("Authorization", "")
    if not header.startswith("Basic "):
        return _unauthorized()

    try:
        decoded = base64.b64decode(header[6:]).decode("utf-8")
        username, password = decoded.split(":", 1)
    except Exception:
        return _unauthorized()

    if not (
        hmac.compare_digest(username, expected_username)
        and hmac.compare_digest(password, expected_password)
    ):
        return _unauthorized()

    return await call_next(request)