"""Dogfood API — minimal FastAPI app that consumes the iurban-auth SDK.

Proves the SDK against the real Keycloak realm (no mocks): tokens issued by
`keycloak.tools.iurban-lab.es/realms/iurban` are validated statelessly via the
realm JWKS. Run it with the OIDC env vars pointing at the realm:

    IURBAN_OIDC_ISSUER=https://keycloak.tools.iurban-lab.es/realms/iurban \
    IURBAN_OIDC_AUDIENCE=dogfood-api \
    uv run --with fastapi --with uvicorn --with .. uvicorn main:app --port 8080

Then call it with a real bearer token (see README for how to mint one).
"""

from fastapi import Depends, FastAPI

from iurban_auth import CurrentUser, current_user, require_roles

app = FastAPI(title="iurban-auth dogfood API")


@app.get("/health")
def health() -> dict:
    return {"status": "ok"}


@app.get("/me")
def me(user: CurrentUser = Depends(current_user)) -> dict:
    """Any authenticated caller. Echoes the identity the SDK extracted."""
    return {
        "sub": user.sub,
        "email": user.email,
        "tenant_id": user.tenant_id,
        "roles": user.roles,
    }


@app.get("/admin")
def admin(user: CurrentUser = Depends(require_roles("dogfood-admin"))) -> dict:
    """Requires the `dogfood-admin` realm role (Option A: the app authorizes)."""
    return {"ok": True, "sub": user.sub, "roles": user.roles}
