"""FastAPI 依赖：数据库会话 + 鉴权。"""
from __future__ import annotations

import jwt as pyjwt
from fastapi import Depends
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

from core.security import decode_token

_bearer = HTTPBearer(auto_error=False)


async def get_current_user(
    credentials: HTTPAuthorizationCredentials | None = Depends(_bearer),
) -> dict:
    """校验 Bearer JWT，返回 payload。

    MVP：单用户宽松模式 —— 未带 / 失效 token 也放行（返回匿名身份），
    后续加账户体系时再收紧为强制校验。
    """
    if credentials is None or not credentials.credentials:
        return {"sub": "app", "anonymous": True}
    try:
        return decode_token(credentials.credentials)
    except pyjwt.PyJWTError:
        return {"sub": "app", "anonymous": True}