from tasteful.authn.oidc import OIDCAuthenticationBackend

# OIDC Backend with automatic discovery
oidc_backend = OIDCAuthenticationBackend(
    name="app_auth",
    metadata_url="https://auth.company.com/.well-known/openid_configuration",
    client_id="your-client-id",
    client_secret="your-client-secret",
    scopes="openid profile email roles"
)

# Integration with TastefulApp
app = TastefulApp(
    title="Secure Application",
    authentication_backends=[oidc_backend],  # FastAPI dependencies
    flavors=[UserFlavor]
)

class UserController(BaseController):
    @Get("/profile")
    async def get_profile(self, request: Request):
        user: OIDCUser = request.state.user  # Automatically available
        return {"name": user.name, "email": user.user_info.get("email")}
    
    @Get("/admin")
    async def admin_only(self, request: Request):
        user: OIDCUser = request.state.user
        
        # Manual authorization (formal system planned)
        roles = user.user_info.get("roles", [])
        if "admin" not in roles:
            raise HTTPException(status_code=403, detail="Admin access required")
        
        return {"message": "Admin access granted"}

from tasteful.authn.base import AsyncAuthenticationBackend

class APIKeyBackend(AsyncAuthenticationBackend):
    async def authenticate(self, request: Request) -> BaseUser | None:
        api_key = request.headers.get("X-API-Key")
        if api_key and await self.validate_api_key(api_key):
            return BaseUser(name="api_user")
        return None

class MockAuthBackend:
    def __init__(self, mock_user: BaseUser):
        self.mock_user = mock_user
    
    async def __call__(self, request):
        request.state.user = self.mock_user

@pytest.fixture
def authenticated_client():
    mock_auth = MockAuthBackend(BaseUser(name="test_user"))
    app = create_app(authentication_backends=[mock_auth])
    return TestClient(app.app)