class AuthenticatedPgHero
  def initialize(app)
    @app = app
  end

  def call(environment)
    request = Rack::Auth::Basic::Request.new(environment)
    if valid_credentials?(request)
      @app.call(environment)
    else
      [401, { "Content-Type" => "text/plain", "WWW-Authenticate" => 'Basic realm="PgHero Administration"' }, ["Anmeldung erforderlich"]]
    end
  end

  private

  def valid_credentials?(request)
    return false unless request.provided? && request.basic?
    expected_user = ENV.fetch("PGHERO_USERNAME", "admin")
    expected_password = ENV["PGHERO_PASSWORD"].to_s
    supplied_user, supplied_password = request.credentials
    return false if expected_password.blank?
    ActiveSupport::SecurityUtils.secure_compare(supplied_user.to_s, expected_user) && ActiveSupport::SecurityUtils.secure_compare(supplied_password.to_s, expected_password)
  end
end