"""中控调用实例 API 时的鉴权辅助（各 crypto_monitor_* 的 login_required 共用）。"""

from __future__ import annotations

import os

from flask import request


def hub_bridge_token() -> str:
    return (os.getenv("HUB_BRIDGE_TOKEN") or "").strip()


def request_allowed(session_logged_in: bool, auth_disabled: bool) -> bool:
    if auth_disabled or session_logged_in:
        return True
    tok = hub_bridge_token()
    if tok and request.headers.get("X-Hub-Token") == tok:
        return True
    return False