import secrets

from fastapi import Depends, HTTPException
from fastapi.security import HTTPBasic, HTTPBasicCredentials

from app.core.config import SETTINGS_PASSWORD

_security = HTTPBasic()


def require_settings_password(credentials: HTTPBasicCredentials = Depends(_security)) -> None:
    """設定画面（/api/settings）専用の簡易パスワード認証。ユーザー名は見ない。

    SETTINGS_PASSWORD が未設定の場合は、空パスワードでの突破を防ぐため常に拒否する。
    """
    if not SETTINGS_PASSWORD:
        raise HTTPException(status_code=403, detail="SETTINGS_PASSWORD is not configured on the server")
    if not secrets.compare_digest(credentials.password, SETTINGS_PASSWORD):
        raise HTTPException(
            status_code=401,
            detail="Invalid password",
            headers={"WWW-Authenticate": "Basic"},
        )