import secrets

from fastapi import Security
from fastapi.security import APIKeyHeader

from .config import get_settings
from .errors import APIError

api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)


def require_api_key(api_key: str | None = Security(api_key_header)) -> None:
    expected = get_settings().api_key
    if not api_key or not secrets.compare_digest(api_key, expected):
        raise APIError(status_code=401, detail="Invalid or missing API key")