DM_POLICY_OPEN = "open"
DM_POLICY_PAIRING = "pairing"
DM_POLICY_ALLOWLIST = "allowlist"
DM_POLICY_DISABLED = "disabled"

VALID_DM_POLICIES = {
    DM_POLICY_OPEN,
    DM_POLICY_PAIRING,
    DM_POLICY_ALLOWLIST,
    DM_POLICY_DISABLED,
}


class BlueskySecurity:
    def __init__(self):
        self.default_policy = DM_POLICY_PAIRING

    async def resolve_dm_policy(self, config: dict, account_id: str) -> str:
        bluesky_cfg = config.get("channels", {}).get("bluesky", {})
        account_cfg = bluesky_cfg.get("accounts", {}).get(account_id, bluesky_cfg)
        policy = account_cfg.get("dmPolicy", self.default_policy)
        return policy if policy in VALID_DM_POLICIES else self.default_policy

    def resolve_allow_from(self, config: dict, account_id: str) -> list[str]:
        bluesky_cfg = config.get("channels", {}).get("bluesky", {})
        account_cfg = bluesky_cfg.get("accounts", {}).get(account_id, bluesky_cfg)
        raw = account_cfg.get("allowFrom", [])
        return [entry.replace("did:", "").strip().lower() for entry in raw if entry.strip()]

    async def authorize(self, sender_did: str, dm_policy: str, allow_from: list[str]) -> str:
        normalized = sender_did.strip().lower()

        if dm_policy == DM_POLICY_OPEN:
            return "allow"
        if dm_policy == DM_POLICY_DISABLED:
            return "block"
        if dm_policy == DM_POLICY_ALLOWLIST:
            return "allow" if normalized in allow_from else "block"
        if dm_policy == DM_POLICY_PAIRING:
            return "allow" if normalized in allow_from else "pairing"
        return "block"