"""Dependencies for the authenticated Agent queue protocol."""

import hmac
from typing import Annotated

from fastapi import Header, HTTPException

from app.agent_commands.repository import AgentCommandRepository
from app.agent_commands.service import AgentCommandService
from app.config import settings


def get_agent_command_service() -> AgentCommandService:
    return AgentCommandService(AgentCommandRepository())


def require_agent_identity(
    agent_id: Annotated[str | None, Header(alias="X-MinerOps-Agent-ID")] = None,
    provided_secret: Annotated[
        str | None, Header(alias="X-MinerOps-Agent-Secret")
    ] = None,
) -> str:
    expected_id = settings.minerops_agent_id.strip()
    expected_secret = settings.minerops_agent_shared_secret.strip()
    if not expected_id or not expected_secret:
        raise HTTPException(status_code=503, detail="Agent authentication is not configured")

    secret = (provided_secret or "").strip()
    if not secret or not hmac.compare_digest(secret, expected_secret):
        raise HTTPException(status_code=401, detail="Invalid or missing Agent secret")

    identity = (agent_id or "").strip()
    if not identity:
        raise HTTPException(status_code=401, detail="Missing Agent identity")
    if not hmac.compare_digest(identity, expected_id):
        raise HTTPException(status_code=403, detail="Agent identity is not authorized")
    return identity