"""Microsoft Teams 多租户验证与隔离。

验证 Activity 来源 Tenant 是否在允许列表中，支持
单租户和多租户两种模式。
"""

from __future__ import annotations

from yuxi.utils.logging_config import logger


class TenantValidator:
    def __init__(self, allowed_tenants: set[str] | None = None):
        self._allowed_tenants = allowed_tenants or set()

    @property
    def mode(self) -> str:
        return "restricted" if self._allowed_tenants else "open"

    def validate(self, channel_data: dict | None) -> bool:
        if not self._allowed_tenants:
            return True
        tenant_id = ""
        if channel_data:
            tenant = channel_data.get("tenant")
            if isinstance(tenant, dict):
                tenant_id = tenant.get("id", "")
        if tenant_id not in self._allowed_tenants:
            logger.warning(f"MSTeams tenant '{tenant_id}' not in allowed_tenants")
            return False
        return True

    def set_allowed_tenants(self, tenants: list[str]) -> None:
        self._allowed_tenants = set(tenants)