"""Authentication dependencies.

Phase 0 milestone 0.2: placeholder `get_current_user` that always raises 401.
Milestone 0.3 replaces this with a JWT-verifying implementation that also
issues the `iam.assurance_level` claim on the token.

Kept as its own module so the RBAC engine and router factory can import it now
and milestone 0.3's swap is a single-file change.
"""

from __future__ import annotations

from fastapi import HTTPException, status

from ypms.users.models import User


def get_current_user() -> User:
    """Placeholder. Milestone 0.3 lands real JWT verification.

    Raises 401 for any route that goes through it. Tests that need to exercise
    RBAC or routes without a real auth stack override this dependency with a
    fixture-provided User via `app.dependency_overrides`.
    """
    raise HTTPException(
        status.HTTP_401_UNAUTHORIZED,
        detail={"error": "unauthenticated", "phase": "milestone 0.3 lands JWT auth"},
    )