"""Authentication middleware and API Key dependency."""

import os
from typing import Optional

from fastapi import HTTPException, Security, status
from fastapi.security import APIKeyHeader

API_KEY_HEADER = APIKeyHeader(name="X-API-Key", auto_error=False)


def verify_api_key(x_api_key: Optional[str] = Security(API_KEY_HEADER)) -> str:
    expected_key = os.getenv("API_KEY", "demo-secret-key")

    # If API_KEY environment variable is set to empty or 'disabled', skip verification
    if os.getenv("DISABLE_AUTH", "false").lower() == "true":
        return "unauthenticated"

    if not x_api_key or x_api_key != expected_key:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or missing X-API-Key header",
        )
    return x_api_key