"""Token verifiers for the HTTP ingest seam.

`verify_token` (cl.agent_seam.context) takes a `TokenVerifier = Callable[[str], Optional[dict]]` that maps an
opaque token to its claims (or None to fail closed). For real deployments this is a JWT/OIDC verifier behind
the same callable. `static_token_verifier` is the DEMO-TRUST stand-in — a fixed allowlist of token → claims —
clearly NOT production identity; it exists so a demo host (e.g. Tali's first live test) has a working signed
context without standing up an IdP. Rotate/replace before any real exposure.
"""

from __future__ import annotations

from typing import Mapping, Optional

from cl.agent_seam.context import TokenVerifier


def make_claims(
    *,
    sub: str,
    tenant: str,
    iss: str = "urn:cotrugli:demo-trust",
    aud: str = "urn:cotrugli:ledger",
    scopes: tuple = ("agent:execute",),
    iat: str = "1970-01-01T00:00:00Z",
    exp: str = "2100-01-01T00:00:00Z",
    jti: str = "demo",
) -> dict:
    """Build the claims dict `verify_token` projects into a `VerifiedContext`."""
    return {
        "iss": iss,
        "aud": aud,
        "sub": sub,
        "tenant": tenant,
        "scopes": list(scopes),
        "iat": iat,
        "exp": exp,
        "jti": jti,
    }


def static_token_verifier(tokens: Mapping[str, dict]) -> TokenVerifier:
    """DEMO-TRUST ONLY — a fixed token→claims allowlist. NOT production identity (no signature, no expiry
    enforcement beyond the claims). An unknown token returns None → `verify_token` fails closed."""
    table = {t: dict(c) for t, c in tokens.items()}

    def verify(token: str) -> Optional[dict]:
        claims = table.get(token)
        return dict(claims) if claims is not None else None

    return verify
