app = FastAPI(
    title='OpenHands',
    description='OpenHands: Code Less, Make More',
    version=get_version(),
    lifespan=combine_lifespans(*lifespans),
    routes=[Mount(path='/mcp', app=mcp_app)],
)

@app.exception_handler(AuthenticationError)
async def authentication_error_handler(request: Request, exc: AuthenticationError):
    return JSONResponse(
        status_code=401,
        content=str(exc),
    )

app.include_router(v1_router.router)
app.include_router(health_router)

if os.getenv('SERVE_FRONTEND', 'true').lower() == 'true':
    if os.path.isdir('./frontend/build'):
        app.mount(
            '/', SPAStaticFiles(directory='./frontend/build', html=True), name='dist'
        )

app.add_middleware(LocalhostCORSMiddleware)
app.add_middleware(CacheControlMiddleware)
app.add_middleware(
    RateLimitMiddleware,
    rate_limiter=InMemoryRateLimiter(requests=10, seconds=1),
)

from fastapi import APIRouter

from openhands.app_server.app_conversation import app_conversation_router
from openhands.app_server.config_api.config_router import router as config_router
from openhands.app_server.event import event_router
from openhands.app_server.event_callback import webhook_router
from openhands.app_server.git.git_router import router as git_router
from openhands.app_server.pending_messages.pending_message_router import (
    router as pending_message_router,
)
from openhands.app_server.sandbox import sandbox_router, sandbox_spec_router
from openhands.app_server.secrets.secrets_router import (
    router as secrets_router,
)
from openhands.app_server.settings.settings_router import (
    router as settings_router,
)
from openhands.app_server.user import skills_router, user_router
from openhands.app_server.web_client import web_client_router

# Include routers
router = APIRouter(prefix='/api/v1')
router.include_router(event_router.router)
router.include_router(app_conversation_router.router)
router.include_router(pending_message_router)
router.include_router(sandbox_router.router)
router.include_router(sandbox_spec_router.router)
router.include_router(settings_router)
router.include_router(secrets_router)
router.include_router(user_router.router)
router.include_router(skills_router.router)
router.include_router(webhook_router.router)
router.include_router(web_client_router.router)
router.include_router(git_router)
router.include_router(config_router)

class LocalhostCORSMiddleware(CORSMiddleware):
    """Custom CORS middleware that allows any request from localhost/127.0.0.1 domains,
    while using standard CORS rules for other origins.
    """
    def __init__(self, app: ASGIApp) -> None:
        config = get_global_config()
        allow_origins = tuple(config.permitted_cors_origins)
        super().__init__(
            app,
            allow_origins=allow_origins,
            allow_credentials=True,
            allow_methods=['*'],
            allow_headers=['*'],
        )

    def is_allowed_origin(self, origin: str) -> bool:
        if origin and not self.allow_origins and not self.allow_origin_regex:
            parsed = urlparse(origin)
            hostname = parsed.hostname or ''
            # Allow any localhost/127.0.0.1 origin regardless of port
            if hostname in ['localhost', '127.0.0.1']:
                return True
            # Allow any origin when no specific origins are configured (dev mode)
            logging.getLogger(__name__).warning(
                f'No CORS origins configured, allowing origin: {origin}. '
                'Set OH_PERMITTED_CORS_ORIGINS for production environments.'
            )
            return True
        result: bool = super().is_allowed_origin(origin)
        return result

class CacheControlMiddleware(BaseHTTPMiddleware):
    async def dispatch(
        self, request: Request, call_next: RequestResponseEndpoint
    ) -> Response:
        response = await call_next(request)
        if request.url.path.startswith('/assets'):
            # Fingerprinted filenames → aggressive caching
            response.headers['Cache-Control'] = 'public, max-age=2592000, immutable'
        else:
            response.headers['Cache-Control'] = (
                'no-cache, no-store, must-revalidate, max-age=0'
            )
            response.headers['Pragma'] = 'no-cache'
            response.headers['Expires'] = '0'
        return response

class InMemoryRateLimiter:
    def __init__(self, requests: int = 2, seconds: int = 1, sleep_seconds: int = 1):
        self.requests = requests
        self.seconds = seconds
        self.sleep_seconds = sleep_seconds
        self.history = defaultdict(list)

    async def __call__(self, request: Request) -> bool:
        key = request.client.host if request.client else 'unknown'
        now = datetime.now()
        self._clean_old_requests(key)
        self.history[key].append(now)

        if len(self.history[key]) > self.requests * 2:
            return False
        elif len(self.history[key]) > self.requests:
            if self.sleep_seconds > 0:
                await asyncio.sleep(self.sleep_seconds)
                return True
            else:
                return False
        return True

class RateLimitMiddleware(BaseHTTPMiddleware):
    def is_rate_limited_request(self, request: StarletteRequest) -> bool:
        return not (
            request.url.path.startswith('/assets')
            or self._is_sandbox_resume_request(request)
        )

    def _is_sandbox_resume_request(self, request: StarletteRequest) -> bool:
        return request.method == 'POST' and bool(_RESUME_RE.match(request.url.path))
    # _RESUME_RE = re.compile(r'^/api/v1/sandboxes/[^/]+/resume/?$')

class Injector(Generic[T], ABC):
    """Object designed to facilitate dependency injection"""

    @abstractmethod
    async def inject(
        self, state: InjectorState, request: Request | None = None
    ) -> AsyncGenerator[T, None]:
        """Inject an object. The state object may be used to store variables for
        reuse by other injectors, as injection operations may be nested."""
        yield None

    @contextlib.asynccontextmanager
    async def context(
        self, state: InjectorState, request: Request | None = None
    ) -> AsyncGenerator[T, None]:
        """Context function suitable for use in async with clauses"""
        async for result in self.inject(state, request):
            yield result

    async def depends(self, request: Request) -> AsyncGenerator[T, None]:
        """Depends function suitable for use with FastAPI dependency injection."""
        async for result in self.inject(request.state, request):
            yield result

class AppServerConfig(OpenHandsModel):
    # Dependency Injection Injectors
    llm_model: LLMModelServiceInjector | None = None
    event: EventServiceInjector | None = None
    event_callback: EventCallbackServiceInjector | None = None
    sandbox: SandboxServiceInjector | None = None
    sandbox_spec: SandboxSpecServiceInjector | None = None
    app_conversation_info: AppConversationInfoServiceInjector | None = None
    app_conversation: AppConversationServiceInjector | None = None
    pending_message: PendingMessageServiceInjector | None = None
    user: UserContextInjector | None = None
    jwt: JwtServiceInjector | None = None
    httpx: HttpxClientInjector = Field(default_factory=HttpxClientInjector)
    db_session: DbSessionInjector = Field(default_factory=DbSessionInjector)
    lifespan: AppLifespanService | None = Field(default_factory=_get_default_lifespan)
    app_mode: AppMode = AppMode.OPENHANDS

if config.event is None:
    provider = get_storage_provider()
    if provider == StorageProvider.AWS:
        config.event = AwsEventServiceInjector(bucket_name=bucket_name)
    elif provider == StorageProvider.GCP:
        config.event = GoogleCloudEventServiceInjector(bucket_name=bucket_name)
    else:
        config.event = FilesystemEventServiceInjector()

_SESSION_API_KEY = os.getenv('SESSION_API_KEY')
_SESSION_API_KEY_HEADER = APIKeyHeader(name='X-Session-API-Key', auto_error=False)

def check_session_api_key(
    session_api_key: str | None = Depends(_SESSION_API_KEY_HEADER),
):
    if session_api_key != _SESSION_API_KEY:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED)

def get_dependencies() -> list[Depends]:
    result = []
    if _SESSION_API_KEY:
        result.append(Depends(check_session_api_key))
    elif get_global_config().app_mode == AppMode.SAAS:
        result.append(Depends(APIKeyHeader(name='X-Access-Token', auto_error=False)))
    return result

class UserAuth(ABC):
    """Abstract base class for user authentication.

    This is an extension point in OpenHands that allows applications to provide their own
    authentication mechanisms. Applications can substitute their own implementation by:
    1. Creating a class that inherits from UserAuth
    2. Implementing all required methods
    3. Setting server_config.user_auth_class to the fully qualified name of the class
    """
    @abstractmethod
    async def get_user_id(self) -> str | None:
    @abstractmethod
    async def get_user_email(self) -> str | None:
    @abstractmethod
    async def get_access_token(self) -> SecretStr | None:
    @abstractmethod
    async def get_provider_tokens(self) -> PROVIDER_TOKEN_TYPE | None:
    @abstractmethod
    async def get_user_settings_store(self) -> SettingsStore:
    @abstractmethod
    async def get_secrets_store(self) -> SecretsStore:
    @abstractmethod
    async def get_secrets(self) -> Secrets | None:

class OpenHandsError(HTTPException):
    """General Error"""
    def __init__(self, detail=None, headers=None,
                 status_code=HTTP_500_INTERNAL_SERVER_ERROR): ...

class AuthError(OpenHandsError):
    """Error in authentication."""
    def __init__(self, detail=None, headers=None,
                 status_code=HTTP_401_UNAUTHORIZED): ...

class PermissionsError(OpenHandsError):
    """Error in permissions."""
    def __init__(self, detail=None, headers=None,
                 status_code=HTTP_403_FORBIDDEN): ...

class SandboxError(OpenHandsError): ...

class SandboxDeleteRetryError(OpenHandsError):
    """The sandbox exists but its delete could not complete and was kept for retry.
    503 (vs 404) so a client distinguishes 'still here, try again' from 'not found'"""
    def __init__(self, detail=None, headers=None,
                 status_code=HTTP_503_SERVICE_UNAVAILABLE): ...

router = APIRouter(tags=['Status'])

@router.get('/alive')
async def alive():
    """Endpoint for liveness probes.
    If this responds then the server is considered alive."""
    return {'status': 'ok'}

@router.get('/health')
async def health() -> str:
    """Health check endpoint. Used by load balancers and orchestrators."""
    return 'OK'

@router.get('/ready')
async def ready() -> str:
    """Endpoint for readiness probes."""
    return 'OK'

@router.get('/server_info')
async def get_server_info():
    """Returns system info: CPU count, memory usage, runtime details."""
    return get_system_info()