# api/middleware/idempotency.py (new file)

from fastapi import Request, HTTPException
from typing import Callable, Awaitable
import hashlib
import json
from datetime import datetime, timedelta, timezone

class IdempotencyStore(Protocol):
    """Pluggable backend for idempotency cache."""
    def get(self, key: str) -> Optional[CachedResponse]: ...
    def put(self, key: str, value: CachedResponse, ttl_seconds: int) -> None: ...

class InMemoryIdempotencyStore:
    """Default OSS backend - simple dict with TTL."""
    def __init__(self):
        self._cache: dict[str, tuple[CachedResponse, datetime]] = {}
    
    def get(self, key):
        entry = self._cache.get(key)
        if not entry:
            return None
        cached, expires_at = entry
        if datetime.now(timezone.utc) > expires_at:
            del self._cache[key]
            return None
        return cached
    
    def put(self, key, value, ttl_seconds):
        expires = datetime.now(timezone.utc) + timedelta(seconds=ttl_seconds)
        self._cache[key] = (value, expires)

async def idempotency_middleware(request: Request, call_next):
    if request.method != "POST":
        return await call_next(request)
    
    idem_key = request.headers.get("Idempotency-Key")
    if not idem_key:
        return await call_next(request)
    
    # Hash the request body so we can detect mismatched-body retries
    body = await request.body()
    body_hash = hashlib.sha256(body).hexdigest()
    cache_key = f"{idem_key}:{request.url.path}"
    
    cached = idempotency_store.get(cache_key)
    if cached:
        if cached.body_hash != body_hash:
            raise HTTPException(
                status_code=409,
                detail="Idempotency-Key reused with different request body",
            )
        return Response(
            content=cached.response_body,
            status_code=cached.status_code,
            media_type="application/json",
        )
    
    response = await call_next(request)
    # cache successful 2xx responses
    if 200 <= response.status_code < 300:
        idempotency_store.put(
            cache_key,
            CachedResponse(body_hash=body_hash, status_code=response.status_code, response_body=...),
            ttl_seconds=24 * 3600,
        )
    return response