"""Auth is NOT re-implemented here — it already lives in the shared andrea_svc_auth package
(API-key OR Keycloak OIDC, constant-time, fail-closed, never by-IP). This module just re-exports
the DRF class + the permission classes so a service imports auth from one place:

    from andrea_svc_web.auth import ServiceOrOIDCAuthentication, ServiceKeyRequiredIfConfigured

    class MyView(StormSafeAPIView):                 # data plane: unchanged, open when unconfigured
        authentication_classes = [ServiceOrOIDCAuthentication]
        permission_classes = [ServiceKeyRequiredIfConfigured]

    class MyAdminView(StormSafeAPIView):            # control plane: never open, even unconfigured
        authentication_classes = [ServiceOrOIDCAuthentication]
        permission_classes = [ServiceKeyRequired]

The auth class is config-driven off settings the base already wires (ANDREA_SVC_KEYS from
ANDREA_SVC_API_KEY; OIDC_ISSUER/OIDC_JWKS_URL) — so turning auth on is purely a deployment-env
decision, no code change. `settings.ANDREA_SVC_KEYS` is kept LIVE per request by
CredsRefreshMiddleware, so a key that lands in a declared env file is honoured on the NEXT request
with no restart and no reload POST (andrea_svc_web.creds.refresh_auth_settings).
"""
from andrea_svc_auth.django_auth import ServiceOrOIDCAuthentication

from .permissions import (CredentialsNotProvisioned, ServiceKeyRequired,
                          ServiceKeyRequiredIfConfigured)

__all__ = ["ServiceOrOIDCAuthentication", "ServiceKeyRequiredIfConfigured", "ServiceKeyRequired",
           "CredentialsNotProvisioned"]
