from typing import Annotated

from anydi.ext.fastapi import Inject
from fansifter_common.api.security import authenticate_identity
from fansifter_common.auth.exceptions import NotAuthenticated
from fansifter_common.auth.identity import Identity
from fansifter_common.constants import DEFAULT_BRAND, HEADER_ORCHARD_IDENTITY_ID
from fastapi import Depends, Security
from fastapi.security import APIKeyHeader, HTTPAuthorizationCredentials, HTTPBearer
from jwtauth import JWTAuth
from starlette.requests import Request

from ows_text_campaigns.config import Settings

bearer_auth = HTTPBearer(
    scheme_name="JWT authorization",
    auto_error=False,
)

orchard_identity_id_auth = APIKeyHeader(
    name=HEADER_ORCHARD_IDENTITY_ID,
    scheme_name="OrchardIdentityId",
    auto_error=False,
)


async def get_identity(
    request: Request,
    credentials: Annotated[HTTPAuthorizationCredentials | None, Security(bearer_auth)],
    orchard_identity_id: Annotated[str | None, Security(orchard_identity_id_auth)],
    jwt_auth: Annotated[JWTAuth, Inject()],
    settings: Annotated[Settings, Inject()],
) -> Identity:
    # Local/dev only header authentication
    if not settings.jwt_auth_enabled:
        if not orchard_identity_id:
            raise NotAuthenticated
        return Identity(
            id=orchard_identity_id,
            brand=DEFAULT_BRAND,
            is_internal_employee=False,
        )
    return await authenticate_identity(
        request, credentials=credentials, jwt_auth=jwt_auth
    )


async def get_identity_id(identity: Annotated[Identity, Depends(get_identity)]) -> str:
    return identity.id


IdentityId = Annotated[str, Depends(get_identity_id)]