"""Auth is NOT re-implemented here — it already lives in the shared andrea_svc_auth package
(API-key OR Keycloak OIDC, constant-time, fail-closed, never by-IP). This module just re-exports
the DRF class + the fail-open-if-unconfigured permission so a service imports auth from one place:

    from andrea_svc_web.auth import ServiceOrOIDCAuthentication, ServiceKeyRequiredIfConfigured

    class MyView(StormSafeAPIView):
        authentication_classes = [ServiceOrOIDCAuthentication]
        permission_classes = [ServiceKeyRequiredIfConfigured]

The auth class is config-driven off settings the base already wires (ANDREA_SVC_KEYS from
ANDREA_SVC_API_KEY; OIDC_ISSUER/OIDC_JWKS_URL) — so turning auth on is purely a deployment-env
decision, no code change.
"""
from andrea_svc_auth.django_auth import ServiceOrOIDCAuthentication

from .permissions import ServiceKeyRequiredIfConfigured

__all__ = ["ServiceOrOIDCAuthentication", "ServiceKeyRequiredIfConfigured"]
