"""Admin authentication with two run modes.

Production (default):
    python src/webui/app.py
    All admin routes return 404. No way to access private features.

Development:
    python src/webui/app.py --dev
    Every request is auto-authenticated as admin. No login needed.

The mode is set once at startup and cannot be changed at runtime.
"""

from __future__ import annotations

from functools import wraps

from flask import abort, g

# Module-level flag set by init_auth()
_dev_mode: bool = False


def is_admin() -> bool:
    """Check if the current request has admin access."""
    return _dev_mode


def admin_required(f):
    """Decorator: returns 404 for non-admin users so routes stay hidden."""
    @wraps(f)
    def decorated(*args, **kwargs):
        if not is_admin():
            abort(404)
        return f(*args, **kwargs)
    return decorated


def init_auth(app, dev: bool = False):
    """Set the auth mode and register Flask hooks."""
    global _dev_mode
    _dev_mode = dev

    @app.before_request
    def set_admin_flag():
        g.is_admin = is_admin()

    @app.context_processor
    def inject_admin():
        return {"is_admin": g.get("is_admin", False)}
