from __future__ import annotations

import logging

logger = logging.getLogger(__name__)


class ZulipSecurity:
    def resolve_dm_policy(self, account: dict) -> dict:
        policy = account.get("dm_policy", "pairing")
        return {"mode": policy, "allow_from": account.get("allow_from", [])}

    def is_stream_allowed(self, stream_name: str, stream_allowlist: list[str]) -> bool:
        if not stream_allowlist:
            return True
        return stream_name in stream_allowlist

    def check_dm_access(
        self,
        sender_email: str,
        account: dict,
    ) -> tuple[bool, str]:
        policy = account.get("dm_policy", "pairing")
        allow_from = account.get("allow_from", [])

        if policy == "open":
            return True, "ok"
        if policy == "disabled":
            return False, "dm_disabled"
        if policy == "allowlist":
            normalized = [e.strip().lower() for e in allow_from]
            if sender_email.lower() in normalized or "*" in normalized:
                return True, "ok"
            return False, "dm_not_allowed"
        if policy == "pairing":
            normalized = [e.strip().lower() for e in allow_from]
            if sender_email.lower() in normalized or "*" in normalized:
                return True, "ok"
            return False, "pairing_required"

        return False, "unknown_policy"

    def collect_warnings(
        self,
        config: dict,
        account_id: str | None = None,
        account: dict | None = None,
    ) -> list[str]:
        warnings = []
        if account:
            if not account.get("stream_allowlist"):
                warnings.append("stream_allowlist 为空，Bot 将响应所有 Stream")
            if account.get("dm_policy") == "open":
                warnings.append("DM 策略设为 open，任何用户均可发起私聊")
        return warnings