"""A2A (agent-to-agent) bearer auth — same scheme as the rest of the mesh."""
from fastapi import Request, HTTPException

from app.config import get_settings


async def verify_a2a_key(request: Request) -> str:
    auth = request.headers.get("authorization", "")
    if not auth.startswith("Bearer "):
        raise HTTPException(status_code=401, detail="Missing A2A auth token")
    token = auth[7:].strip()
    allowed = [k.strip() for k in get_settings().A2A_ALLOWED_KEYS.split(",")]
    if token not in allowed:
        raise HTTPException(status_code=403, detail="Invalid A2A auth token")
    return token