"""MCP-side Bearer token resolution. Reuses the existing api_keys infrastructure."""
from __future__ import annotations

from scribe.services.api_keys import lookup_key


async def resolve_bearer_to_user_id(auth_header: str | None) -> int | None:
    """Parse an `Authorization: Bearer <token>` header and return the user_id.

    Returns None if the header is missing, malformed, or the token is invalid
    or revoked. The underlying lookup_key already updates last_used_at on hit.
    """
    if not auth_header or not auth_header.startswith("Bearer "):
        return None
    raw_token = auth_header[len("Bearer "):].strip()
    if not raw_token:
        return None
    api_key = await lookup_key(raw_token)
    return api_key.user_id if api_key else None


async def resolve_bearer(auth_header: str | None) -> tuple[int, str] | None:
    """Resolve a Bearer token to (user_id, scope).

    scope is 'read' or 'write'. Returns None for a missing/malformed/invalid
    token. The MCP dispatch layer uses scope to deny write-class tool calls
    from read-only keys — the same read/write boundary the REST API enforces.
    """
    if not auth_header or not auth_header.startswith("Bearer "):
        return None
    raw_token = auth_header[len("Bearer "):].strip()
    if not raw_token:
        return None
    api_key = await lookup_key(raw_token)
    if api_key is None:
        return None
    return api_key.user_id, (api_key.scope or "write")