"""drf-spectacular extension: teach the schema generator about the shared auth class so EVERY
service's OpenAPI documents its security scheme. Without this, ServiceOrOIDCAuthentication (which
andrea_svc_auth synthesises lazily) is 'unresolvable' and the X-Agent-Key scheme is silently dropped
from the spec. Registered on import; andrea_svc_web.apps.AndreaSvcWebConfig.ready() imports it."""
from drf_spectacular.extensions import OpenApiAuthenticationExtension


class ServiceApiKeyScheme(OpenApiAuthenticationExtension):
    target_class = "andrea_svc_auth.django_auth.ServiceOrOIDCAuthentication"
    name = "ServiceApiKey"

    def get_security_definition(self, auto_schema):
        from django.conf import settings
        header = getattr(settings, "ANDREA_API_KEY_HEADER", "X-Agent-Key")
        return {
            "type": "apiKey",
            "in": "header",
            "name": header,
            "description": "Andrea internal service key (constant-time, fail-closed). An OIDC "
                           "bearer is also accepted when the service enables the OIDC path.",
        }
