from slowapi import Limiter
from slowapi.util import get_remote_address
from fastapi import Request
from jose import jwt, JWTError
from app.config import settings


def _get_client_key(request: Request) -> str:
    # Try JWT first
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer "):
        token = auth[7:]
        try:
            payload = jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.JWT_ALGORITHM])
            return f"client:{payload.get('sub', 'unknown')}"
        except JWTError:
            pass

    # Fall back to API key header hash or IP
    api_key = request.headers.get("X-API-Key")
    if api_key:
        return f"apikey:{api_key[:16]}"

    return get_remote_address(request)


limiter = Limiter(key_func=_get_client_key)