import "server-only";

import { jsonError } from "@/lib/http/json";

/**
 * Checks the Authorization header against AGENT_API_TOKEN.
 *
 * Same pattern as /api/cron/reconcile's CRON_SECRET check — a second secret
 * of the same kind, for a second machine caller. Returns the Response to
 * send when the caller must be refused, or null when the request may
 * proceed, so every route starts with:
 *
 *   const denied = requireAgentToken(request);
 *   if (denied) return denied;
 */
export function requireAgentToken(request: Request): Response | null {
  const secret = process.env.AGENT_API_TOKEN;
  if (!secret) {
    console.error("[agent-api] AGENT_API_TOKEN is not set; refusing all requests");
    return jsonError("Not configured", 500);
  }

  if (request.headers.get("authorization") !== `Bearer ${secret}`) {
    return jsonError("Unauthorized", 401);
  }

  return null;
}