"""Stub auth integration for PKB.

This module is the integration point between PKB and a real OAuth provider.
The function `get_current_user(ctx)` returns the authenticated user id.

For lessons 09-10 we read the user from `PKB_USER` env var (single-process
dev). In a remote deployment (Lessons 13-14), swap the body to extract the
`sub` claim from a validated OAuth access token off `ctx.request_context`.
"""

from __future__ import annotations

import os

from mcp.shared.exceptions import McpError
from mcp.types import ErrorData, INVALID_PARAMS


def get_current_user(ctx) -> str:
    """Return the authenticated user id, or raise McpError if missing.

    Stub implementation. Real impl: extract claim from validated OAuth token.
    """
    user = os.environ.get("PKB_USER", "").strip()
    if not user:
        raise McpError(ErrorData(
            code=INVALID_PARAMS,
            message="not authenticated (PKB_USER env var not set)",
        ))
    return user