"""
Simple session-based authentication for the web panel.
Credentials are set via environment variables in .env.
"""
import os
import hashlib
import hmac
from functools import wraps
from flask import session, redirect, url_for, request

PANEL_USERNAME = os.getenv("PANEL_USERNAME", "admin")
_PANEL_PASSWORD_HASH = os.getenv(
    "PANEL_PASSWORD_HASH",
    # default: sha256("admin123") — MUST be changed in production
    hashlib.sha256(b"admin123").hexdigest(),
)


def check_password(password: str) -> bool:
    candidate = hashlib.sha256(password.encode()).hexdigest()
    return hmac.compare_digest(candidate, _PANEL_PASSWORD_HASH)


def login_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        if not session.get("logged_in"):
            return redirect(url_for("login", next=request.path))
        return f(*args, **kwargs)
    return decorated