# LangChain tool: deterministic pre-execution security scan via ScanPay.
# pip install langchain-core requests
import os
import requests
from langchain_core.tools import tool

SCANPAY = "https://scanpay-edge.alextaghiashvili.workers.dev"
HEADERS = {"Content-Type": "application/json", "X-API-Key": os.environ.get("SCANPAY_API_KEY", "")}


@tool
def scanpay_scan(source_code: str, language: str = "python") -> dict:
    '''Use BEFORE executing AI-generated code. Returns deterministic findings; block on critical/high.'''
    r = requests.post(f"{SCANPAY}/api/v1/key/scan",
                      json={"source_code": source_code, "language": language},
                      headers=HEADERS, timeout=30)
    if r.status_code == 402:
        return {"error": "no credits", "buy": "POST /api/v1/credits-micro ($0.10 for 5 scans)"}
    r.raise_for_status()
    data = r.json()
    data["block"] = any(f.get("severity") in ("critical", "high") for f in data.get("findings", []))
    return data