import hashlib
from django.utils import timezone
from rest_framework.authentication import BaseAuthentication, get_authorization_header
from rest_framework.exceptions import AuthenticationFailed
from .models import AccessToken

def digest(token): return hashlib.sha256(token.encode()).hexdigest()
class BearerAuthentication(BaseAuthentication):
    def authenticate(self,request):
        parts=get_authorization_header(request).split()
        if not parts or parts[0].lower()!=b'bearer': return None
        if len(parts)!=2: raise AuthenticationFailed('Ungültiges Token')
        try: token=AccessToken.objects.select_related('user').get(digest=digest(parts[1].decode()),expires_at__gt=timezone.now(),user__is_active=True)
        except (AccessToken.DoesNotExist,UnicodeDecodeError): raise AuthenticationFailed('Sitzung abgelaufen')
        return token.user,token
    def authenticate_header(self,request): return 'Bearer'