package main

import (
	"encoding/json"
	"log"
	"net/http"
	"os"
)

func main() {
	secret := os.Getenv("DEMO_API_KEY")
	if secret == "" {
		log.Fatal("DEMO_API_KEY is required")
	}

	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		got := r.Header.Get("Authorization")
		valid := got == "Bearer "+secret
		log.Printf("request host=%s path=%s authorization_present=%t valid=%t",
			r.Host, r.URL.Path, got != "", valid)

		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]any{
			"authenticated":         valid,
			"authorization_present": got != "",
			"host":                  r.Host,
		})
	})

	server := &http.Server{
		Addr:    ":443",
		Handler: handler,
	}
	log.Print("real HTTPS upstream listening on :443")
	log.Fatal(server.ListenAndServeTLS("/certs/upstream.crt", "/certs/upstream.key"))
}