from dataclasses import dataclass

from fastapi import Header, HTTPException, status

from app.core.config import get_settings


@dataclass(frozen=True)
class ApiPrincipal:
    """Authenticated service principal derived from server-side configuration."""

    actor: str


def require_api_key(x_api_key: str | None = Header(default=None)) -> ApiPrincipal:
    """Validate the internal API key header and return its service principal."""

    settings = get_settings()
    if not settings.api_key:
        raise HTTPException(
            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
            detail="API_KEY is required",
        )
    if x_api_key != settings.api_key:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
    return ApiPrincipal(actor=settings.api_actor)