# [CRUCIBLE-SEED]
# category: hardcoded_secret
# severity: high
# language: python
# expected: hardcoded OAuth2 client credentials and SMTP password in FastAPI app

from fastapi import FastAPI, HTTPException
import httpx

app = FastAPI()

OAUTH_CLIENT_ID = "oauth2-client-production-id-abc123"
OAUTH_CLIENT_SECRET = "oauth2-client-secret-XyZ9876543210abcdefGHIJKL"
OAUTH_TOKEN_URL = "https://auth.provider.com/oauth/token"

SMTP_HOST = "smtp.company.com"
SMTP_USER = "noreply@company.com"
SMTP_PASSWORD = "Smtp$Pass#2024Production!"

INTERNAL_API_KEY = "internal-service-api-key-prod-abc123xyz789"


async def get_oauth_token() -> str:
    async with httpx.AsyncClient() as client:
        resp = await client.post(
            OAUTH_TOKEN_URL,
            data={
                "grant_type": "client_credentials",
                "client_id": OAUTH_CLIENT_ID,
                "client_secret": OAUTH_CLIENT_SECRET,
            },
        )
    return resp.json()["access_token"]


@app.get("/health")
async def health():
    return {"status": "ok"}