"""Bearer-token check for every route except /healthz."""

from __future__ import annotations

import hmac

from fastapi import Request

from .errors import MediaError


def require_token(request: Request) -> None:
    expected: str = request.app.state.settings.token
    header = request.headers.get("authorization", "")
    scheme, _, presented = header.partition(" ")
    if (
        scheme.lower() != "bearer"
        or not presented
        or not expected
        or not hmac.compare_digest(presented.strip().encode(), expected.encode())
    ):
        raise MediaError("unauthorized", "missing or invalid bearer token")