"""通用 FastAPI 依赖"""
from __future__ import annotations

from fastapi import Depends, HTTPException, status

from app.core.roles import ADMIN_ROLES
from app.services.auth_service import get_current_user


def require_roles(*roles: str):
    """生成「限定角色」依赖，避免同一个内联判断被复制到每个端点。

    用法::

        @router.get("/x")
        async def x(current_user: dict = Depends(require_admin)):
            ...

    失败一律 403 且不透露允许的角色集合（避免给探测者提供线索）。
    """
    allowed = frozenset(roles)

    async def _guard(current_user: dict = Depends(get_current_user)) -> dict:
        if (current_user or {}).get("role") not in allowed:
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail="当前角色无权访问该接口",
            )
        return current_user

    return _guard


# 审计日志等高权限接口复用同一实例
require_admin = require_roles(*ADMIN_ROLES)