"""Server-side Hub credential, never included in API status or job records."""
import json
import os
from pathlib import Path
import re
import tempfile
import threading

class HubAuth:
    def __init__(self,path):
        self.path=Path(path)
        self.lock=threading.RLock()
    def token(self):
        with self.lock:
            try:return json.loads(self.path.read_text())['token']
            except FileNotFoundError:return None
    def status(self):
        return {'configured':bool(self.token())}
    def save(self,token):
        if token is not None and (not isinstance(token,str) or not re.fullmatch(r'hf_[A-Za-z0-9]{10,252}',token)):
            raise ValueError('Bitte einen gültigen Hugging-Face-Token (hf_…) eingeben.')
        with self.lock:
            if token is None:
                self.path.unlink(missing_ok=True)
                return
            self.path.parent.mkdir(parents=True,exist_ok=True,mode=0o700)
            fd,name=tempfile.mkstemp(prefix='.hub-',dir=self.path.parent)
            try:
                with os.fdopen(fd,'w') as out:
                    json.dump({'token':token},out);out.flush();os.fsync(out.fileno())
                os.replace(name,self.path)
            finally:
                Path(name).unlink(missing_ok=True)