import hashlib
from fastapi import APIRouter, HTTPException, Depends, Header
from pydantic import BaseModel
from config import settings

router = APIRouter(prefix="/api/auth", tags=["auth"])

_tokens: set[str] = set()


class LoginRequest(BaseModel):
    password: str


class VerifyRequest(BaseModel):
    token: str


def hash_password(pw: str) -> str:
    return hashlib.sha256(f"{pw}:livestream-salt".encode()).hexdigest()


ADMIN_HASH = hash_password(settings.admin_password)


async def require_auth(authorization: str = Header(None)) -> bool:
    if not authorization:
        raise HTTPException(status_code=401, detail="Missing token")
    token = authorization.replace("Bearer ", "")
    if token not in _tokens:
        raise HTTPException(status_code=401, detail="Invalid token")
    return True


@router.post("/login")
async def login(body: LoginRequest):
    if hash_password(body.password) != ADMIN_HASH:
        raise HTTPException(status_code=401, detail="Invalid password")
    token = hashlib.sha256(f"{body.password}:token".encode()).hexdigest()
    _tokens.add(token)
    return {"token": token}


@router.post("/verify")
async def verify(body: VerifyRequest):
    if body.token not in _tokens:
        raise HTTPException(status_code=401, detail="Invalid token")
    return {"valid": True}