"""Temporary edge header-trust probe (ACC-10614). Remove after edge sign-off.

Log-only. When a request carries ``X-Edge-Probe`` equal to ``config.EDGE_PROBE_TOKEN``, this
logs the client IP and the identity headers exactly as this app received them after ProxyFix
and the edge. Curling through the real edge (with and without forged headers) then reveals what
the edge actually forwards, so ``PROXYFIX_X_FOR`` and the strip/re-inject guarantee can be
verified per environment. Disabled when the token is unset; it never alters the response.
"""

from __future__ import annotations

import logging

from flask import Flask, request

from core.config import Config

logger = logging.getLogger(__name__)

_PROBE_HEADER = 'X-Edge-Probe'
# The client-forgeable identity inputs the rate limiter keys on (see client_ip.principal_key).
_OBSERVED_HEADERS = (
    'Orchard-User-Id',
    'Orchard-Identity-Id',
    'Orchard-Requestor-Service',
)


def install_edge_probe(app: Flask, config: type[Config]) -> None:
    """Register a log-only ``before_request`` that echoes edge-forwarded headers for probe calls.

    No-op unless ``config.EDGE_PROBE_TOKEN`` is set, so normal traffic is never touched.
    """
    token = config.EDGE_PROBE_TOKEN
    if not token:
        return

    @app.before_request
    def _log_edge_probe() -> None:
        if request.headers.get(_PROBE_HEADER) != token:
            return
        observed = {name: request.headers.get(name) for name in _OBSERVED_HEADERS}
        logger.info(
            'edge probe remote_addr=%s access_route=%s x_forwarded_for=%r identity_headers=%r',
            request.remote_addr,
            request.access_route,
            request.headers.get('X-Forwarded-For'),
            observed,
        )