feat: add safe miner control foundation

backend/app/agent_commands/dependencies.py

@@ -0,0 +1,37 @@
+"""Dependencies for the authenticated Agent queue protocol."""
+
+import hmac
+from typing import Annotated
+
+from fastapi import Header, HTTPException
+
+from app.agent_commands.repository import AgentCommandRepository
+from app.agent_commands.service import AgentCommandService
+from app.config import settings
+
+
+def get_agent_command_service() -> AgentCommandService:
+    return AgentCommandService(AgentCommandRepository())
+
+
+def require_agent_identity(
+    agent_id: Annotated[str | None, Header(alias="X-MinerOps-Agent-ID")] = None,
+    provided_secret: Annotated[
+        str | None, Header(alias="X-MinerOps-Agent-Secret")
+    ] = None,
+) -> str:
+    expected_id = settings.minerops_agent_id.strip()
+    expected_secret = settings.minerops_agent_shared_secret.strip()
+    if not expected_id or not expected_secret:
+        raise HTTPException(status_code=503, detail="Agent authentication is not configured")
+
+    secret = (provided_secret or "").strip()
+    if not secret or not hmac.compare_digest(secret, expected_secret):
+        raise HTTPException(status_code=401, detail="Invalid or missing Agent secret")
+
+    identity = (agent_id or "").strip()
+    if not identity:
+        raise HTTPException(status_code=401, detail="Missing Agent identity")
+    if not hmac.compare_digest(identity, expected_id):
+        raise HTTPException(status_code=403, detail="Agent identity is not authorized")
+    return identity