"""/docs Basic Auth：对齐 server/security.py。明文密码，常量时间比较。"""

from __future__ import annotations

import secrets

from fastapi import Depends, HTTPException, status
from fastapi.security import HTTPBasic, HTTPBasicCredentials

from .config import get_settings

security = HTTPBasic()


def require_docs_auth(credentials: HTTPBasicCredentials = Depends(security)) -> str:
    s = get_settings()
    if not s.docs.enabled or not s.docs.password:
        raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="docs disabled")
    ok_user = secrets.compare_digest(credentials.username.encode(), s.docs.username.encode())
    ok_pass = secrets.compare_digest(credentials.password.encode(), s.docs.password.encode())
    if not (ok_user and ok_pass):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="invalid credentials",
            headers={"WWW-Authenticate": f'Basic realm="{s.docs.realm}"'},
        )
    return credentials.username