#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import functools
from aiohttp import web

def panel_auth(handler):
    """面板专用鉴权装饰器：基于面板自有的 Session Store 验证"""
    @functools.wraps(handler)
    async def wrapper(request, *args, **kwargs):
        # 1. 获取 Token
        token = request.cookies.get("panel_token")
        if not token and request.headers.get("Authorization", "").startswith("Bearer "):
            token = request.headers["Authorization"].split(" ", 1)[1]
            
        is_valid = False
        
        # 2. 从面板 Session Store 验证
        session_store = request.app.get('panel_session_store', {})
        if token and token in session_store:
            is_valid = True
            # 验证通过，将用户信息注入 request 供后续使用
            request['user'] = session_store[token]
        
        # 3. 拦截逻辑 (不再依赖外部 AuthService，确保安全隔离)
        if not is_valid:
            # 返回 401 并附带提示，前端可据此判断状态
            return web.json_response({
                "error": "未认证或会话已过期", 
                "status": 401
            }, status=401)
            
        return await handler(request, *args, **kwargs)
    return wrapper